CVE-2026-97859

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

EUVD-2026-103993

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859

Seven Gitea API routes under "/api/v1/users/username" followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the "individualPermsChecker" middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859: Missing Authorization

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

PT-2026-117157

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.3 Gitea versions prior to 28.0.0 Description Seven API endpoints under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys, and gpg keys were registered without the...

Gitea authorization issue vulnerability

Gitea 1.27.2 and earlier versions have an authorization issue. This issue arises from the lack of the individualPermsChecker middleware during the registration of seven API routes under /api/v1/users/username. This failure does not enforce visibility for target users, potentially allowing...