–
Not scored
CVE-2026-119627
Gitea limited-visibility profile disclosure with public-only tokens
gitea.dev · CWE-1220 · CWE-1220Affectedgitea.dev
FixUpdate to 28.3.0 or newer
PublishedNov 1, 09:48 · Gitea
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.
From Gitea
Affected and fixed versions
ProductAffectedFixed ingitea.devbefore 28.3.028.3.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known