Access Control Flaw in Gitea Web Profile and Feed Routes
CVE-2026-119627

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-119627?

A significant vulnerability in Gitea arises from improper checks in the web profile and RSS/Atom feed routes. This flaw fails to enforce the 'public-only' restriction of personal access tokens, allowing any user with a public-only token to access the profile and activity feeds of users and organizations marked with limited visibility. As a result, sensitive profile metadata and public activities can be disclosed, which are otherwise hidden from anonymous visitors. It’s crucial for users to apply patches and updates to mitigate this security risk.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39690
patch
https://github.com/go-gitea/gitea/pull/39853
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/manus-pi
https://github.com/silverwind
https://github.com/bircni
.