This flaw stems from several Gitea API endpoints under /api/v1/users/{username} that were registered without the required visibility checker middleware. An authenticated user can exploit this to read the followers, following chain, starred or watched repositories, and the public SSH and GPG keys of any user who has limited or private visibility. The data exposed includes the user’s private social graph and cryptographic keys, leading to a privacy breach and potential compromise of user identity and authentication material. The weakness is characterized as an improper access control flaw (CWE‑862).

The vulnerability exists in Gitea releases prior to the fixes that landed in version 1.27.3 and the 28.0.0 release line. Any deployment running Gitea 1.27.x or 28.0.x before these patch releases, including the 28.2.0 release that shipped the issue, is affected. Upgrading to at least 1.27.3 or 28.0.0 or later resolves the problem.

The vulnerability requires an attacker to possess authenticated credentials, but the impact is significant because it allows disclosure of sensitive private data. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Nevertheless, an authenticated user with privileged rights could use the exposed endpoints to harvest personal data, and the absence of visibility checks could be abused to map social connections and key material across the platform. The CVSS score of 6.5 indicates a moderate severity.