A restricted account can use the SSH and GPG key‑list API endpoints to retrieve public keys, key titles, fingerprints, and embedded email addresses that belong to users whose profile visibility is limited. The flaw arises from a missing profile visibility check in the API, while the web interface correctly enforces it. The violation is a misconfigured access control weakness (CWE‑284) that leads to disclosure of user metadata, not private cryptographic material.

The vulnerability affects installations of Gitea, regardless of version, as the specific bug existed prior to the release of 1.27.3.

The CVSS score of 4.3 indicates moderate impact for confidentiality. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited but possible exploitation. Attackers need only send an HTTP request to the exposed API endpoints, requiring no elevated privileges or special credentials beyond those of a restricted account. However, the data exposed consists only of public key metadata and does not enable privilege escalation or further compromise. The description does not explicitly state the attack method, but it is inferred that a restricted account can trigger the vulnerability by accessing the key‑list API.