This flaw stems from several Gitea API endpoints under /api/v1/users/{username} that were registered without the required visibility checker middleware. An authenticated user can exploit this to read the followers, following chain, starred or watched repositories, and the public SSH and GPG keys of any user who has limited or private visibility. The data exposed includes the user’s private social graph and cryptographic keys, leading to a privacy breach and potential compromise of user identity and authentication material. The weakness is characterized as an improper access control flaw (CWE‑862).

The vulnerability exists in Gitea releases prior to the fixes that landed in version 1.27.3 and the 28.0.0 release line. Any deployment running Gitea 1.27.x or 28.0.x before these patch releases, including the 28.2.0 release that shipped the issue, is affected. Upgrading to at least 1.27.3 or 28.0.0 or later resolves the problem.

The vulnerability requires an attacker to possess authenticated credentials, but the impact is significant because it allows disclosure of sensitive private data. No EPSS score is reported and the flaw is not listed in the CISA KEV catalog, which suggests that the likelihood of exploitation is not high at present. Nevertheless, an authenticated user with privileged rights could use the exposed endpoints to harvest personal data, and the absence of visibility checks could be abused to map social connections and key material across the platform.