Improper API permissions in Gitea affecting user data visibility
CVE-2026-97859
6.5MEDIUM
What is CVE-2026-97859?
The Gitea application has a critical issue involving improper access control across seven API routes pertaining to user management. Due to the absence of the individualPermsChecker middleware, authenticated users could access sensitive information such as followers, following lists, starred repositories, and public SSH and GPG keys of users with restricted visibility settings. This vulnerability potentially exposes private information that would normally be inaccessible. Affected versions prior to 1.27.3 and 28.0.0 lack this crucial check, allowing unauthorized data retrieval. The issue has been remedied in version 28.2.0.
Affected Version(s)
Gitea 0 <= 1.27.2
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
https://github.com/lukegranto23
https://github.com/KadirArslan
https://github.com/DshtAnger
https://github.com/DevNoScope
https://github.com/gigioneggiando
https://github.com/manus-pi
https://github.com/bircni