CVE-2026-68957: Gitea restricted-user issue search disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-14
Weakness: CWE-284

Description

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.

Affected products

Gitea Open Source Git Server: through 1.27.2

References

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39004
https://github.com/go-gitea/gitea/pull/39039
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-wg93-gp4m-c6vr

Get alerted when CVE-2026-68957 or the next vulnerability affects your stack