The RemoveDependency function in Gitea's issue dependency management does not verify permissions when removing dependencies across repositories. It fetches the dependency issue by its global ID without checking if the user has access rights to the target repository. Consequently, an attacker with write access to issues in one repository can remove a dependency linked to an issue in a private repository they cannot access and add a comment attributed to themselves on that private issue. This is a broken access control vulnerability (CWE-862) that allows unauthorized write actions crossing repository boundaries. The AddDependency function correctly enforces permission checks for cross-repository dependencies, but RemoveDependency does not. The issue affects all versions prior to 1.27.0.

An attacker with write access to issues in one repository can tamper with issue dependency relationships and inject comments into issues in private repositories without having read or write access to those private repositories. The vulnerability does not disclose repository content but allows unauthorized modification of issue-tracking state and insertion of attacker-authored comments, violating repository access controls. The impact is limited to existing dependency links and does not allow broader repository compromise or data leakage.

A fix is available in Gitea version 1.27.0 and later, which adds proper cross-repository permission checks in the RemoveDependency function to ensure the user has read access to the target repository's issues before allowing dependency removal. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until then, restrict issue write permissions carefully and monitor for suspicious dependency removals. Patch status is confirmed by the affectedVersions field indicating versions prior to 1.27.0 are vulnerable.