CVE-2026-97859None▾ SunlitSeven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Seven Gitea API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.
gitea.dev <= 1.27.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109844NoneGitea watched repositories API disclosure after access revocation
CVE-2026-97204NoneGitea label deletion across repository and organization IDs
CVE-2026-109553NoneGitea SSH certificate principal impersonation of other users
CVE-2026-107618NoneGitea cross-site request forgery on repository topics
CVE-2026-105661NoneGitea panic on the repositories route of individual users
CVE-2026-110324NoneGitea private profile information disclosure through POST request