CVE-2026-68964: Gitea restricted-user SSH and GPG key metadata disclosure
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs a restricted Gitea account. The issue allows that account to query the affected SSH and GPG key-list API endpoints.
Which users' information can be exposed?
Limited-visibility users are affected. Their public SSH or GPG key material and associated metadata may be disclosed to restricted accounts.
Are private SSH or GPG keys exposed?
No. The disclosure is limited to public key material and metadata, including key titles, fingerprints, and email addresses embedded in GPG keys.