Gitea API Vulnerability Affects Limited-Visibility Repository Privacy
CVE-2026-68957

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-68957?

A security issue in Gitea's API and web interfaces allows users with restricted accounts to access issue titles and bodies that should be concealed under the owner's visibility settings. This vulnerability misclassifies these users as anonymous viewers, enabling them to inadvertently discover sensitive information related to limited-visibility repositories. By utilizing keyword searches, restricted users may expose hidden content, including comments, that the repository owners intended to keep private.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39004
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Mon3mRT
https://github.com/Black1hp
https://github.com/bircni
https://github.com/silverwind
.