Activity Feed and Contribution Heatmap API Vulnerability in Gitea
CVE-2026-67577

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-67577?

Gitea's activity-feed and contribution-heatmap API handlers are vulnerable to a flaw that allows restricted users to bypass profile visibility checks. This oversight permits unauthorized access to sensitive activity records and contribution timestamps of users whose profiles are set to limited visibility. Affected users may unknowingly expose information such as repository names, commit messages, and events related to issues or pull requests, thus exposing critical data tied to public-repository activities. It is crucial for users and administrators to ensure they apply the latest security patches to mitigate this exposure.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39004
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Mon3mRT
https://github.com/Black1hp
https://github.com/bircni
https://github.com/silverwind
.