Gitea's handling of HTTP requests containing the '?go-get=1' query parameter, used by the Go toolchain to discover VCS metadata, bypasses normal authentication and authorization. The function EarlyResponseForGoGetMeta is called unconditionally and returns HTTP 200 with repository metadata even for private repositories and unauthenticated users. This behavior enables attackers to confirm private repository existence, enumerate repository names without triggering authentication failures, and obtain clone URLs and default branch names. The affected code is in routers/web/repo/githttp.go and services/context/repo.go. The vulnerability affects all Gitea versions prior to 1.27.0.

An unauthenticated attacker can confirm the existence of private repositories by name, enumerate private repository names through brute force, and harvest clone URLs and default branch names. This information disclosure can aid further targeted attacks or reconnaissance but does not directly expose repository contents or allow unauthorized access to repository data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the Gitea instance at the network level or disabling the '?go-get=1' handling if feasible. Monitor vendor communications for an official fix or temporary mitigation.