CVE-2026-68964

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key...

CVE-2026-68957

An authenticated account marked restricted can search and read issues belonging to Limited-visibility users through the issue-search API and web issue-search route. Affected responses include full issue titles and bodies, and keyword searches can surface issue content through matches in titles,...