User SSH and GPG Key Exposure in Gitea by Go-Gitea
CVE-2026-68964

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-68964?

Gitea's user SSH and GPG key-list API endpoints do not enforce the necessary profile visibility checks seen in their web interfaces, allowing users with restricted access to gather sensitive information, such as public keys, key titles, fingerprints, and GPG-embedded email addresses of limited-visibility users. This vulnerability poses a risk by disclosing public key material and associated metadata, while private cryptographic keys remain unaffected.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39004
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Mon3mRT
https://github.com/Black1hp
https://github.com/bircni
https://github.com/silverwind
.