Medium severity · published Oct 14, 2026
CVE-2026-68957
Gitea restricted-user issue search disclosure
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Gitea · Gitea
through 1.27.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-68957
vendor-advisory
https://github.com/go-gitea/gitea/security/advisories/GHSA-wg93-gp4m-c6vr
release-notes
https://blog.gitea.com/release-of-1.27.3/
patch
https://github.com/go-gitea/gitea/pull/39004
patch
https://github.com/go-gitea/gitea/pull/39039
release-notes
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
More from Gitea
9.8
CVE-2026-60004
Gitea Code Injection Vulnerability
9.8
CVE-2026-59774
Gitea Org-mode file disclosure and code execution
9.8
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in
9.8
CVE-2026-94205
Gitea fork workflow approval bypass through maintainer-triggered events
9.8
CVE-2022-42968
Gitea before 1.17.3 does not sanitize and escape refs in the git backend