CVE-2026-68964

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The user SSH and GPG key-list API endpoints fail to perform the profile visibility checks that are present in the web interface. This allows a restricted account to retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses from users with limited visibility. The issue involves the disclosure of public key material and metadata rather than private cryptographic keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.