The vulnerability in Gitea's /api/v1/teams/{id} API routes stems from improper enforcement of the public-only token restriction. The middleware that checks token restrictions relies on organization visibility via ctx.Org.Organization, which is not loaded in these routes, causing the check to silently pass. Additionally, team repository handlers do not apply repository-level public-only access checks, and the team activity feed handler includes private data without filtering for public-only tokens. Consequently, a public-only token can access private team resources that should be restricted.

An attacker or user with a public-only token can access private team repository metadata and private activity feed information that should be inaccessible. This leads to unintended information disclosure of private organizational resources, potentially exposing sensitive project details to unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using public-only tokens in contexts where team API routes might be accessed, or restrict API token usage to trusted users. Monitor vendor communications for updates and apply patches promptly once available.