CVE-2026-68964CWE-284broken-access-control

CVE-2026-68964

Medium · published October 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-14T19:17Z
References (5)
https://blog.gitea.com/release-of-1.27.3/ · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39004 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39039 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/releases/tag/v1.27.3 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/security/advisories/GHSA-wwmh-7r9x-fg49 · 88ee5874-cf24-4952-aea0-31affedb7ff2
EPSS history
Timeline
  • 16 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 14 OCT 14:36Z
    Gitea restricted-user SSH and GPG key metadata disclosure
    cvelistv5
  • 14 OCT 14:36Z
    Gitea restricted-user SSH and GPG key metadata disclosure
    cvelistv5