The shared comparison helper in Gitea omits the repository‑access check that normally protects pulling changes that require user permission. A public‑only token with read:repository scope can therefore drive a comparison or pull‑request creation through a public base repository and retrieve commit history and diffs from a private head repository that the token owner already has access to. This bypasses the token’s public‑only restriction while leaving the underlying repository permission model intact, exposing private repository content to users who only possess a public‑only token.

Gitea installations running any version prior to v1.27.3 are vulnerable. The advisory notes that the issue was fixed in the 1.27.3 release, so earlier builds must be upgraded.

With a CVSS score of 6.5, the vulnerability presents a moderate security risk. No EPSS score is available, and the flaw is not currently listed in CISA’s KEV catalog. A malicious actor who can obtain a valid public‑only token for a user that owns a private repository can trigger the comparison or pull‑request API endpoint to pull unrevealed changes from a private head repository, effectively leaking private diffs and history. The exploit requires only an API call; no elevated privileges or exploit code are needed beyond the normal token usage.