Improper API permissions in Gitea affecting user data visibility

CVE-2026-97859

What is CVE-2026-97859?

The Gitea application has a critical issue involving improper access control across seven API routes pertaining to user management. Due to the absence of the individualPermsChecker middleware, authenticated users could access sensitive information such as followers, following lists, starred repositories, and public SSH and GPG keys of users with restricted visibility settings. This vulnerability potentially exposes private information that would normally be inaccessible. Affected versions prior to 1.27.3 and 28.0.0 lack this crucial check, allowing unauthorized data retrieval. The issue has been remedied in version 28.2.0.

References