User Profile Information Exposure in Gitea by Go Gitea

CVE-2026-110324

What is CVE-2026-110324?

A vulnerability in Gitea allows authenticated users to access private profile information, such as a user's full name, location, website, and description, through specific GET requests. This flaw arises because visibility checks were only applied to GET requests. As a result, an authenticated user can exploit this oversight when interacting with the 'follow' and 'unfollow' functionalities to retrieve sensitive information from another user's account with a private profile. The issue has been addressed in Gitea version 28.1.0 and was disclosed with version 28.2.0.

References