Gitea uses inconsistent predicates for repository visibility. Some listing endpoints allow repositories whose owners are meant to be hidden, so the listings expose metadata that should have been suppressed. Direct routes correctly deny access with a 404, but the listings still reveal which repositories exist and their meta, enabling an attacker to discover hidden repositories and potentially other details such as names, owners, and descriptions.

The flaw exists in all Gitea installations running a version released before 1.27.3. The product affected is the Gitea repository hosting service, regardless of where it is deployed, as long as the vulnerable code is in use.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. An attacker can exploit it by sending requests to Gitea's repository‑listing endpoints over the network, with or without authentication, to enumerate hidden repositories. The fix removes the inconsistent visibility check, so after upgrading the listings no longer reveal hidden owner data.