CVE-2026-68957

CVSS 4.3 (medium) · published 2026-10-14

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.

Weakness: CWE-284

Source: NVD CVE-2026-68957

References

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39004
• https://github.com/go-gitea/gitea/pull/39039
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-wg93-gp4m-c6vr

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.