Gitea’s Actions workflow status badge endpoint fails to enforce the repository‑read or public‑only restrictions on the token used in the request. A token without the read:repository scope, or one limited to public repositories, can still retrieve the latest workflow status of a private repository that the token’s owner can access, revealing private workflow information beyond the token’s intended permissions. The weakness is a privilege‑bypass identified as CWE‑863.

Affected versions are all Gitea releases prior to v1.27.3. The issue was fixed in the 1.27.3 release, so any instance running v1.27.2 or earlier is vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a publicly reachable workflow badge endpoint; an attacker only needs a token that is not granted repository‑read privileges. Exploitation does not require additional privileges or network compromise, so the risk is moderate but tangible for privacy of private workflows.