Gitea EUVD-2026-103993

Exploitation requires an authenticated Gitea account with a valid API token (read-user scope is sufficient) - it is not remote-unauthenticated. The target must be an individual user configured with 'limited' or 'private' visibility; public users expose this data anyway, so there is no additional disclosure for them. The flaw works against default configurations of affected versions (Gitea ≤1.27.2) with no special setting needed. Limiting factors: authentication is mandatory, scope is unchanged (single target user per request), and the disclosed data is low-sensitivity relationship metadata plus SSH/GPG keys that are inherently public - no credentials, source code, or private repository contents are exposed.

This is a moderate, lower-priority information-disclosure issue rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) correctly reflects a network-reachable, low-complexity flaw requiring an authenticated account (PR:L) with no integrity or availability impact. All exploitation signals point low: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified - only vendor PR diffs and advisories, which demonstrate the fix, not a weaponized exploit. The main point of tension is the confidentiality rating: the vendor-provided vector uses C:H, but the data actually exposed is low-sensitivity relationship metadata (followers, following, starred/watched repos) plus SSH and GPG keys that the description itself calls 'public' - so C:H arguably overstates impact, and a C:L assessment is more defensible (see assessed vector). Net: a genuine access-control gap worth patching on a normal cadence, but not a drop-everything priority given authentication is required, impact is metadata disclosure, and there is no evidence of exploitation.

An authenticated Gitea user (any account with a read-user API token) queries another user's API endpoints such as /api/v1/users/{username}/followers or /keys. Because the visibility middleware is missing, the server returns the follower/following lists, starred and watched repositories, and public SSH/GPG keys of a target whose profile is set to limited or private - information the requester should not be able to see. No public exploit code exists, but exploitation is trivial given the AV:N/AC:L vector and requires only a standard logged-in session.