SecNews@SecNews_GR
Gitea API: Η CVE-2026-97859 παρακάμπτει ελέγχους ορατότητας https://www.secnews.gr/741351/gitea-api-cve-2026-97859/?fsp_sid=19761
00000104
7.0K followersView on X
CVE-2026-97859
LOWCVSS 6.5 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-862
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day