A repository collaborator with administrative privileges can call the collaboration access-mode endpoint to grant themselves the Owner access mode. This bypasses the boundary that should separate repository administration from ownership, allowing the attacker to perform all owner‑only actions, such as transferring the repository to their own account or altering any repository‑level settings. The flaw is an authorization bypass that could lead to full control over a repository's contents and configuration.

The vulnerability impacts the Gitea platform. No specific version range is listed in the data, but the related release 1.27.2 contains the fix according to the vendor documentation. Administrators should verify that their Gitea deployment is at least this version or later.

The EPSS score of 0.00193 indicates a very low but non‑zero probability of exploitation, and the CVE is not listed in the CISA KEV catalog. An attacker only needs to be a collaborator with Admin rights, a credential that is already required for repository management. Once the endpoint is abused, the attacker can assume owner status and thereafter acquire unrestricted repository privileges. The risk is therefore high for any environment where non‑owner collaborators have administrative permissions, but the exploit is straightforward and does not require additional access vectors or prerequisites beyond the existing collaborator role.