Gitea's repository markup endpoint fails to enforce the viewer's Pull Requests permission when resolving same‑repository pull request references. This flaw, classified as CWE-284: Improper Access Control, allows a user who only has Wiki access to a private repository to submit a markup preview request and obtain the title and state icon of a private pull request. The result is leaking pull request metadata to individuals who otherwise lack Issues or Pull Requests rights, increasing the surface of potential attack information.

Any Gitea installation running a version older than 1.27.3 is susceptible. The flaw affects private repositories configured with separate unit permissions; only the scenarios where Wiki rights are granted but Pull Requests rights are not. Admins should confirm the server version and ensure that the instance has applied the 1.27.3 release or later update.

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% denotes a very low probability of exploitation. Since the vulnerability is not listed in CISA's KEV catalog, there is no evidence of active exploitation. The attack requires an authenticated user with Wiki permission to the private repository, who can then send a markup preview request over HTTP or HTTPS to retrieve the pull request title and state icon. No code execution or privilege escalation is possible through this vector.