When a private repository is transferred to a user who does not have prior access, Gitea temporarily grants that recipient read access as a collaborator so the recipient can inspect the repository. If the transfer is later rejected or cancelled, the collaborator status is not revoked, leaving the recipient with persistent read access to all private data including code, issues, pull requests, wiki and the ability to clone the repository. The owner is not notified that access was retained, meaning private information remains exposed after a transfer rejection.

This vulnerability affects Gitea installations running versions prior to 28.0.0. The 28.0.0 release addresses the issue by removing retained read access from rejected or cancelled transfers while preserving other existing collaborators.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is exploitably via the normal web interface used to transfer repositories; the likely attack vector is initiating or being the target of a repository transfer request. Although not listed in the CISA KEV catalog, the persistence of granted read access can expose confidential code and project data, and the owner’s lack of notification compounds the risk.