CVE-2026-97859 Gitea CVE debrief

Who should care

Gitea administrators and users with limited or private visibility should assess exposure and potential unauthorized access. This includes reviewing the security of their Gitea instances, verifying the exposure of sensitive user data, and taking steps to prevent unauthorized access. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take steps to mitigate them.

Why it matters

Defenders should prioritize verifying exposure of Gitea instances to authenticated users and assess the impact of potential unauthorized access to user social graphs, keys, and stars.

• Potential unauthorized access to user social graphs
• Exposure of private user keys and stars
• Increased risk of targeted attacks on Gitea users
• Need for verification of Gitea instance security

Technical summary

Seven Gitea API routes under `/api/v1/users/{username}` were registered without the `individualPermsChecker` middleware, allowing authenticated users to read private user social graphs, keys, and stars. The affected routes include followers, following, following/{target}, starred, subscriptions, keys, and gpg_keys. This issue was fixed in Gitea versions 1.27.3 and 28.0.0, and defenders should prioritize verifying exposure of Gitea instances to authenticated users and assess the impact of potential unauthorized access to user social graphs, keys, and stars.

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to authenticated users and assess the impact of potential unauthorized access to user social graphs, keys, and stars.

Recommended defensive actions

• Verify Gitea instance exposure to authenticated users
• Assess potential unauthorized access to user social graphs, keys, and stars
• Update Gitea to version 1.27.3 or 28.0.0
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the affected Gitea API routes and the fixed versions. The issue was fixed in Gitea versions 1.27.3 and 28.0.0. The CVE record was published on 2026-10-18T19:01:04.328Z and has not been modified since then. There are references to vendor advisories and patch details on GitHub, which can provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.