Access Token Misconfiguration in Gitea Affects User Activity Data

CVE-2026-114199

What is CVE-2026-114199?

A critical misconfiguration in the Gitea API allows users who possess public-only access tokens to view contribution heatmap data that should remain confidential. This includes the viewing of contribution counts and their corresponding time buckets from private repositories. Although repository names and detailed content are not disclosed, the implications of unauthorized access to user activity can potentially compromise user privacy. Recent fixes in Gitea ensure that the heatmap will now only represent activity that is visible to anonymous users, alleviating this security issue.

References