CVE-2026-68964 in Gitea
Summary
by MITRE • 10/15/2026
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Gitea represents a critical access control failure within the application's API layer, specifically affecting the endpoints responsible for listing user SSH and GPG keys. While the web interface correctly enforces visibility restrictions based on user account types, such as Limited-visibility accounts, these same security checks are absent from the corresponding RESTful API endpoints. This discrepancy creates a significant authentication bypass scenario where an attacker with restricted privileges can circumvent intended privacy controls to harvest sensitive metadata associated with other users' cryptographic identities. The flaw stems from inconsistent implementation of authorization logic between different client interfaces within the same application ecosystem, highlighting a common architectural weakness in web applications that fail to centralize or uniformly apply security policies across all entry points.
From a technical perspective, this vulnerability allows an authenticated user operating under limited permissions to query public keys, key titles, fingerprints, and GPG-embedded email addresses of users who have explicitly set their profiles to private or limited visibility. Although the attacker does not gain access to private cryptographic material, which remains secure, the exposure of public key metadata constitutes a serious information disclosure risk. Public SSH keys are often used for server authentication and can reveal infrastructure details if linked to specific services. More critically, GPG-embedded email addresses provide direct personal identifiable information that can be correlated with other data breaches or used for targeted social engineering attacks. The fingerprint serves as a unique identifier for the key pair, facilitating further reconnaissance by allowing an attacker to track user activity across different platforms where the same keys might be reused.
The operational impact of this vulnerability extends beyond simple privacy violation. It enables malicious actors to build detailed profiles of target users within the Gitea instance without triggering standard security alerts associated with unauthorized access attempts. Since API requests are often automated and less monitored than web interface interactions, an attacker can systematically enumerate keys for multiple limited-visibility users in a short timeframe. This capability aids in reconnaissance phases of cyber attacks, where understanding user relationships and communication channels is essential before launching more sophisticated exploits such as phishing or supply chain compromises via compromised repositories that rely on these identities for code signing verification.
This issue aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks on API endpoints compared to their web counterparts. It also maps to MITRE ATT&CK technique T1087 Account Discovery, as the attacker is enumerating user accounts and associated attributes through legitimate but misconfigured access paths. The vulnerability underscores the importance of treating all application interfaces with equal security rigor, ensuring that backend authorization middleware applies uniformly regardless of whether the request originates from a browser or an API client.
Mitigation strategies must focus on synchronizing the access control logic between web and API layers. Developers should implement centralized permission checks that validate user visibility settings before returning any key-related data in both contexts. Additionally, implementing rate limiting and enhanced logging for these specific endpoints can help detect and prevent bulk enumeration attempts by malicious actors. Organizations using Gitea should immediately apply available patches or updates provided by the maintainers to rectify this authorization bypass. Until patched, administrators may consider restricting API access to trusted internal networks or enforcing stricter authentication requirements if possible, although patching remains the definitive solution to restore intended privacy controls for limited-visibility users.