The vulnerability in Gitea's post-receive git hook handler allows users with owner or admin collaborator access to toggle repository visibility (private/public) and template status using undocumented git push options 'repo.private' and 'repo.template'. These options were intended only for the push-to-create feature but are processed without restriction on existing repositories. The visibility change bypasses audit trails, webhook events, organization notifications, team permission recalculations, email alerts, and does not update the repository's 'updated_at' timestamp due to the use of UpdateRepositoryColsNoAutoTime. This enables stealthy changes to repository visibility and template designation, which can be abused by insiders or collaborators to expose private code or poison template repositories without leaving normal traces.

An attacker with owner or admin collaborator access can covertly change a private repository to public and back without generating audit logs, notifications, or updating timestamps, allowing unauthorized data exposure without detection. Similarly, template repositories can be silently modified to introduce malicious changes that propagate downstream, complicating detection and response. This undermines repository confidentiality, integrity, and trust in template-based supply chains.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict owner and admin collaborator access to trusted users only. Monitor repository visibility and template status changes manually or via external tooling since internal audit and notification mechanisms are bypassed by this vulnerability.