Gitea's RSS/Atom feed handlers accept API-token Basic authentication but fail to enforce the token's scope or public-only restrictions. This flaw permits personal access tokens, which are intended to be confined (such as public-only tokens or tokens without repository scope), to access private repository data via feed routes. The affected feed endpoints expose private commit data, release information, tags, and user activity streams. The vulnerability requires the user to have legitimate read access to the repository, meaning it is a token confinement bypass rather than an unauthorized access vulnerability. This issue affects all Gitea versions before 1.27.0.

The vulnerability allows users with personal access tokens that should be restricted to public data or limited scopes to access private repository content through RSS/Atom feed endpoints. This can lead to unintended exposure of private commit data, release information, tags, and user activity streams. However, it does not allow unauthorized users without repository read access to gain access, so the impact is limited to token scope bypass rather than full unauthorized access.

A patch is available in Gitea version 1.27.0 that addresses this issue. Users and administrators should upgrade to version 1.27.0 or later to ensure proper enforcement of API token scopes and public-only restrictions on RSS/Atom feed handlers. No additional mitigation is required if the system is updated.