The Gitea organization-list API fails to enforce the read:organization token scope, allowing tokens with unrelated scopes, such as read:misc, to retrieve organization metadata that is normally restricted. Because the API returns information visible to the token's owner, a token belonging to a site administrator can expose both limited and private organization data, bypassing the intended access control. This flaw is a type of authorization failure identified as CWE‑285, and it enables unauthorized disclosure of organizational information.

All installations of Gitea, specifically those running versions prior to 1.27.3, are vulnerable because the fix was introduced in the 1.27.3 release. Any deployment that has not applied this version remains susceptible to the token scope bypass.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is currently unavailable, suggesting that opportunistic exploitation is not widespread. The vulnerability can be leveraged by anyone who has an API token with a limited scope; attackers can craft requests to the organization-list endpoint and obtain data that should be restricted. The risk is mainly information disclosure rather than remote code execution or denial of service. Since the flaw does not require elevated privileges beyond token possession and the response data is public to the token's owner, the likelihood of successful exploitation is moderate, and the vulnerability is not listed in the CISA KEV catalog.