When Gitea’s web installer is reachable against a database that already contains users, submitting the install form with an administrator username that matches an existing account creates a valid authenticated session without verifying the supplied password. This flaw permits an attacker who knows an existing administrator username to gain full administrative privileges, including the ability to change passwords and perform all administrative operations, effectively bypassing normal authentication controls.

All Gitea server deployments that expose the installer endpoint while the configuration parameter INSTALL_LOCK is set to false and whose database already holds user data are vulnerable. The advisory indicates that the issue exists in versions prior to the 28.0.0 release, and the patch is included in Gitea 28.0.0 and later versions.

The vulnerability has a CVSS score of 8.1, indicating high severity, and an EPSS score of < 1 %, suggesting a low but non‑zero probability of exploitation. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker who can reach the installer URL and knows an existing administrator username can submit the form and obtain an authenticated session without needing to provide the correct password. Therefore, a remote attacker can gain full administrative control simply by accessing the installer page and providing an administrative username. The lack of a KEV listing does not mitigate the risk for deployments that expose the installer endpoint without adequate protection.