CVE-2026-97859: 
Gitea vulnerability analysis and mitigation

CVE-2026-97859 is a missing authorization vulnerability in Gitea that allows authenticated users to access private or limited-visibility user data through seven unprotected API endpoints. Specifically, routes under /api/v1/users/{username} for followers, following, starred repositories, subscriptions, SSH keys, and GPG keys were registered without the individualPermsChecker middleware that enforces target user visibility settings. All Gitea versions up to and including 1.27.2 are affected. The vulnerability was fixed in versions 1.27.3 and 28.0.0, and publicly disclosed with the release of 28.2.0 on October 18, 2026. It carries a CVSS category estimate of Medium and is classified under CWE-862 (Missing Authorization) (GitHub Advisory, Feedly).

The root cause (CWE-862) lies in routers/api/v1/api.go, where two separate route groups handle /api/v1/users/{username} endpoints. The first group correctly applies the individualPermsChecker middleware for profile, heatmap, repos, and activity feeds. However, a second route group serving the social graph, keys, and starred/watched repositories omits this middleware entirely, and none of the seven handler functions perform their own internal visibility checks (GitHub Advisory). The fix is straightforward — adding individualPermsChecker to the second route group's middleware chain — and was implemented in PR #39004 (main branch) and backported via PR #39039 to the v1.27 release branch (PR #39004, PR #39039). Exploitation requires only a valid authentication token, with no special privileges needed beyond being a registered user on the instance.

An authenticated attacker can enumerate the full follower and following lists, starred and watched repositories, and public SSH and GPG keys of any user who has set their profile to private or limited visibility — completely defeating the privacy control. The GPG key endpoint is particularly sensitive because GPG keys typically embed real names and email addresses, enabling cross-platform identity correlation. For organizations using private visibility to protect employee identities (e.g., government, defense, or security teams), this vulnerability allows an adversary to map internal social graphs, identify colleagues and collaborators, and determine project involvement, potentially facilitating targeted phishing or further reconnaissance (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-97859. The EPSS score is 0.0 and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). However, exploitation is trivially easy for any authenticated user — it requires only a valid API token and knowledge of a target username, with no special tooling needed beyond standard HTTP requests to the affected endpoints. The vulnerability was verified against main branch commit 20221e1 (2026-07-23) through source code review (GitHub Advisory).

1. Obtain authentication: Acquire any valid Gitea API token for the target instance — even a low-privilege user account suffices.
2. Identify target username: Enumerate or guess usernames of users with private or limited visibility profiles. Usernames may be discoverable through public commits, issue comments, or other public activity.
3. Query unprotected endpoints: Send authenticated GET requests to any of the seven affected API routes, for example:
   • GET /api/v1/users/{username}/followers — retrieve full follower list
   • GET /api/v1/users/{username}/gpg_keys — retrieve GPG keys (contains real name and email)
   • GET /api/v1/users/{username}/keys — retrieve SSH public keys
   • GET /api/v1/users/{username}/starred — retrieve starred repositories
   • GET /api/v1/users/{username}/subscriptions — retrieve watched repositories
4. Extract sensitive data: Parse the JSON responses to obtain identity information (real name, email from GPG keys), social graph data (followers/following), and project involvement (starred/watched repos).
5. Pivot or correlate: Use SSH/GPG key fingerprints to correlate the target's identity across other platforms, or use the social graph to identify additional high-value targets within the organization (GitHub Advisory).

• Network: Unusual volume of authenticated API GET requests to /api/v1/users/{username}/followers, /api/v1/users/{username}/following, /api/v1/users/{username}/starred, /api/v1/users/{username}/subscriptions, /api/v1/users/{username}/keys, or /api/v1/users/{username}/gpg_keys — especially targeting multiple different usernames in rapid succession.
• Logs: Gitea access logs showing a single token or IP address querying the above endpoints for many different usernames, particularly for users with private or limited visibility profiles; HTTP 200 responses to these endpoints for users who should not be visible to the requester.
• Behavioral: API token activity from accounts that do not normally use the API, or requests originating from unfamiliar IP addresses or user agents targeting user social graph endpoints.

Gitea has released patched versions 1.27.3 (backport) and 28.0.0 (main branch), with the vulnerability publicly disclosed in 28.2.0. The fix adds the individualPermsChecker middleware to the second /api/v1/users/{username} route group in routers/api/v1/api.go. Administrators should upgrade to Gitea 1.27.3 or 28.0.0 or later as soon as possible. No configuration-based workaround is available since the gap is in the routing middleware layer; upgrading is the only effective remediation (GitHub Advisory, PR #39039, v28.2.0 Release).

The vulnerability was reported by security researchers lukegranto23, KadirArslan, and gigioneggiando, and remediated by Gitea maintainer bircni with review from silverwind and delvh (GitHub Advisory). The advisory notes that the GPG key endpoint is "particularly bad" for organizations using private visibility to protect employee identities in sensitive sectors such as government and defense. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and standard CVE aggregator postings.