When a Git push is authenticated with a deploy key, Gitea incorrectly records the pusher as the repository owner instead of the deploy key. Because the push hook pipeline then evaluates the owner for permission checks, a user holding a writable deploy key can bypass normal authorization controls. This allows the creation of protected tags even if the tag is not on the allow list and enables modification of repository visibility settings—such as turning a private repository public through push options. Additionally, pull requests created through the AGit flow with a deploy key are incorrectly attributed to the repository owner, potentially obscuring the true contributor.

All installations of Gitea running versions prior to the release that fixed the issue are affected, specifically Gitea versions before 28.0.0. The vulnerability is present in the core Gitea application regardless of deployment environment or operating system.

The exploit requires only a deploy key that has write permissions and does not involve complex attacker steps. Although the EPSS score indicates a low probability (<1%) and the vulnerability is not listed in the CISA KEV catalog, the ability to create protected tags and alter repository visibility, coupled with a CVSS score of 7.1, represents a significant privilege escalation risk for exposed or sensitive repositories. The likely attack vector is via deployment of a malicious or misconfigured deploy key, and the risk is heightened for organizations that use deploy keys to automate CI/CD pipelines.