CVE-2026-97859: Gitea Information Disclosure Vulnerability

CVE-2026-97859 Overview

CVE-2026-97859 is a missing authorization vulnerability [CWE-862] in Gitea, the self-hosted Git service. Seven API routes under /api/v1/users/{username} were registered without the individualPermsChecker middleware that enforces target user visibility. An authenticated attacker can query these endpoints to read data belonging to users with limited or private visibility that they would otherwise be unable to see. Exposed data includes followers, following lists, starred and watched repositories, and public SSH and GPG keys. The issue was fixed in Gitea 1.27.3 and 28.0.0 and publicly disclosed with the 28.2.0 release.

Critical Impact

Authenticated users can enumerate relationships, repository interests, and public cryptographic keys of private or limited-visibility Gitea accounts through unprotected API routes.

Affected Products

• Gitea versions prior to 1.27.3 (1.x branch)
• Gitea versions prior to 28.0.0 (28.x branch)
• Self-hosted Gitea deployments exposing the REST API

Discovery Timeline

• 2026-10-18 - CVE-2026-97859 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-97859

Vulnerability Analysis

The vulnerability affects seven routes in Gitea's REST API under the /api/v1/users/{username} prefix. The affected endpoints are followers, following, following/{target}, starred, subscriptions, keys, and gpg_keys. These routes were registered in the router without applying the individualPermsChecker middleware. That middleware is responsible for evaluating whether the requesting user is permitted to view the target account based on Gitea's user visibility settings (public, limited, or private).

Because the middleware was absent, Gitea evaluated only authentication, not authorization against the target user's visibility. Any authenticated user, including a low-privileged account, could therefore query these routes directly and receive the response body for a user they should not be able to see. The disclosed data includes social graph information (followers and following), activity signals (starred and watched repositories), and public SSH and GPG keys.

Root Cause

The root cause is a missing authorization check [CWE-862] in route registration. The handlers themselves relied on an upstream middleware to filter requests targeting non-visible users. When these seven routes were added or restructured, the middleware chain was not applied, leaving the handlers to serve responses without a visibility check.

Attack Vector

Exploitation requires only an authenticated session and knowledge or guessing of a target username. The attacker issues standard HTTP GET requests to the affected API paths, for example /api/v1/users/{username}/followers or /api/v1/users/{username}/keys. No elevated privileges, user interaction, or special tooling is required. For technical details on the fix, see the Gitea Pull Request #39004, Gitea Pull Request #39039, and GitHub Security Advisory GHSA-xvfh-qwmh-f92w.

Detection Methods for CVE-2026-97859

Indicators of Compromise

• Access log entries showing authenticated requests to /api/v1/users/{username}/followers, /following, /starred, /subscriptions, /keys, or /gpg_keys for users set to limited or private visibility.
• A single authenticated account issuing API requests against a large set of distinct {username} values in a short time window, suggesting enumeration.
• Successful HTTP 200 responses from the affected endpoints for target accounts that are not publicly listed.

Detection Strategies

• Parse Gitea access logs and correlate the requesting user's identity against the target user's visibility setting stored in the Gitea database.
• Alert on API-key or token-authenticated clients that query user metadata endpoints at a rate inconsistent with normal UI-driven usage.
• Hunt for enumeration patterns by grouping requests on source IP, token ID, or user ID against the count of distinct target usernames.

Monitoring Recommendations

• Forward Gitea API access logs to a centralized logging platform and retain them for post-incident review.
• Baseline normal per-user API call volume to the /api/v1/users/ namespace and alert on deviations.
• Review authentication token issuance and revoke tokens associated with suspicious enumeration activity.

How to Mitigate CVE-2026-97859

Immediate Actions Required

• Upgrade Gitea to version 1.27.3, 28.0.0, or later immediately. The fix is included in these releases and documented in the Gitea Release Notes v28.2.0.
• Audit public SSH and GPG keys of users with limited or private visibility and rotate any keys considered sensitive after exposure.
• Review API access logs for the affected endpoints to identify potential data enumeration prior to patching.

Patch Information

Gitea addressed the issue by adding the individualPermsChecker middleware to the affected routes. Patches shipped in Gitea 1.27.3 and 28.0.0, and the vulnerability was disclosed alongside the 28.2.0 release. See the Gitea Release Announcement 28.2.0 for upgrade guidance.

Workarounds

• If upgrading immediately is not possible, restrict API access at the reverse proxy by denying unauthenticated or low-trust clients access to /api/v1/users/{username}/followers, /following, /starred, /subscriptions, /keys, and /gpg_keys.
• Reduce exposure by limiting API token issuance and enforcing short token lifetimes for interactive accounts.
• Consider setting the Gitea instance to require sign-in for the broader API surface and limiting account self-registration during the remediation window.

# Example NGINX block to deny the affected API paths until patched
location ~ ^/api/v1/users/[^/]+/(followers|following|starred|subscriptions|keys|gpg_keys)(/|$) {
    return 403;
}