CVE-2026-97859

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...