CVE-2026-68964

Deferred Deferred - Pending Action

Gitea API Exposure of Limited-Visibility User Keys

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-68964

EUVD

EUVD-2026-101092

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Gitea's API endpoints for listing user SSH and GPG keys do not enforce profile visibility checks that are applied in the web interface. This allows restricted users to retrieve public keys, titles, fingerprints, and GPG email addresses of users with Limited-visibility profiles. The issue exposes public key metadata but not private cryptographic keys.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a vulnerable version (1.27.2 or earlier). Use commands like 'gitea --version' to verify the version. Inspect API responses for SSH and GPG key endpoints to see if restricted users can access limited-visibility user data.

Impact Analysis

If you are a Gitea user with a Limited-visibility profile, restricted users may access your public SSH/GPG keys and associated metadata through API endpoints. This could expose information like key fingerprints or email addresses tied to your keys, potentially aiding reconnaissance or social engineering attacks.

Compliance Impact

The vulnerability may impact compliance by exposing user metadata (e.g., GPG email addresses) without consent, potentially violating data protection principles under GDPR or HIPAA if such data is considered sensitive. Organizations using Gitea should upgrade to mitigate exposure.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. This patched version enforces visibility checks on API endpoints, preventing unauthorized access to user keys and metadata. No workarounds exist besides upgrading.

Hi! I’m here to help you understand CVE-2026-68964. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70