Gitea Open Source Git Server is vulnerable to an unauthenticated information disclosure flaw that permits unauthorized access to private repository metadata.

This vulnerability, categorized under CWE-200 and CWE-862, stems from a failure to properly restrict access to repository metadata. An unauthenticated attacker can query the system to retrieve sensitive metadata regarding private repositories even after those permissions have been explicitly revoked.

The exposure of repository metadata can lead to significant intellectual property leakage and unauthorized reconnaissance. By accessing repository names, descriptions, and structural information, an attacker can gain critical intelligence to facilitate further targeted attacks against the development environment. With a CVSS score of 7.5, this high-severity vulnerability presents a substantial risk to organizations relying on Gitea for secure code management.

Immediate Action: Update Gitea to version 1.27.0 or later, as this release includes the necessary security fixes to enforce metadata access controls.

Proactive Monitoring: Review audit logs for unusual or bulk requests to repository metadata endpoints, particularly from unauthenticated sources or unauthorized IP addresses.

Compensating Controls: Implement strict network-level access controls to limit exposure of the Gitea instance to trusted internal networks, and utilize a Web Application Firewall to filter suspicious API queries.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for unauthorized intelligence gathering, organizations must prioritize patching their Gitea instances to version 1.27.0 immediately. Failure to address this vulnerability exposes sensitive development workflows to external reconnaissance, which could serve as a precursor to more damaging intrusions.