Gitea restricted-user issue search disclosure
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.
CVE-2026-68957
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-68957
Gitea
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Gitea",
"product": "Gitea",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "1.27.2"
}
],
"packageName": "Gitea",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-68957
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #22087 · Revision 1
- Added to Heist Feed
- Publisher date