CVE-2026-68964

MEDIUM 4.3

Gitea restricted-user SSH and GPG key metadata disclosure

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.

Vendor	gitea
Product	gitea
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new medium vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 1.27.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-wwmh-7r9x-fg49 blog.gitea.com: https://blog.gitea.com/release-of-1.27.3/ github.com: https://github.com/go-gitea/gitea/pull/39004 github.com: https://github.com/go-gitea/gitea/pull/39039 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.27.3

Credits

https://github.com/Mon3mRT https://github.com/Black1hp https://github.com/bircni https://github.com/silverwind