The Gitea push mirror creation endpoint allows a repository administrator to set up mirrors without the system enforcing the DISABLE_NEW_PUSH policy that is normally applied through the web interface. This enables private repository data to be copied to an attacker‑controlled remote location whenever commits occur or a mirror is scheduled, constituting a breach of confidentiality. The vulnerability stems from insufficient access‑control validation (CWE‑863).

All installations of the Gitea product that run a version older than the patched 28.1.0 release are potentially vulnerable because the fix that checks the DISABLE_NEW_PUSH setting was introduced in that release. The application is the Gitea web service, and the affected API endpoint is POST /api/v1/repos/{owner}/{repo}/push_mirrors. Inferences about the specific affected versions are based on the release notes cited in the advisory.

The path to exploitation requires the attacker to be authenticated as a repository administrator and to send a POST request to the push_mirrors endpoint. No publicly released exploit is known, and the EPSS score of less than 1% indicates that exploitation activity is likely very low. The vulnerability is not listed in the CISA KEV catalog. The low CVSS score of 4.9 suggests the overall severity is low to moderate, but the flaw still permits confidential data to be replicated without authorization. The likely attack vector is an authenticated API request from a compromised or privileged account.