Gitea misapplies the FORCE_PRIVATE configuration when creating empty repositories on push. After a repository is pushed to a newly created empty repo, the post‑receive hook resets the privacy flag to false, overriding the instance policy that Force‑Private is set to true. The result is that any user who can create repositories will inadvertently create a public repository, violating the policy. This represents an authorization bypass, identified as CWE‑863.

The vulnerability affects all Gitea releases that expose the FORCE_PRIVATE setting, specifically instances running Gitea up to and including version 28.1.0 prior to the fix. The default configuration is not altered, so the issue manifests only when administrators explicitly enable FORCE_PRIVATE and grant repository creation rights to authenticated users.

The exploit requires a user with repository creation privileges, a common role in many teams. While the escalation does not provide code execution or compromising system services, it allows an attacker to publish private code publicly, potentially exposing sensitive data. The CVSS score is 5.4, and EPSS is not available; the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation data. Nevertheless, the impact on confidentiality and internal policy compliance is significant, and the attack vector is straightforward: provoke the creation of a repository via a compromised or malicious account.