Gitea user and organization feed token scope bypass
Affects Gitea 28.2.0 and earlier, in the user and organization feed and profile pages. Fixed in 28.3.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 5/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 28.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Gitea, a self-hosted Git service, is affected: its user and organization feed and profile pages could be accessed with access tokens that lacked the proper permissions. As a result, an attacker holding a limited token could view private activity, private repositories, organizations, and profile content belonging to the token owner or, for administrator tokens, any account on the site.
Read the original description
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.
What to do
Check whether your setup matches what the bug needs.
Affected versions are Gitea 28.2.0 and earlier (<= 28.2.0). The attacker must hold a personal access token sent as HTTP Basic authentication to the /{username} route, for the bug to apply; a site administrator's token affects every account.Upgrade to a fixed version: 28.3.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gitea.dev
fixed in 28.3.0
Evidence 5
- Advisory
- Patch
- Patch
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119625
What does this mean?
A personal access token with an unrelated scope could read the token owner's private activity through the user RSS/Atom feeds, and a public-only token could see private repositories and organizations on profile pages. For an administrator's token, this covered every account.Source: github.com, blog.gitea.com
Am I affected, and how do I check?
Gitea 28.2.0 and earlier are affected. The bug applies when a personal access token is sent as HTTP Basic authentication to the /{username} route. To check a installation, look at the Gitea version shown in the site administration dashboard or run gitea --version.Source: github.com, blog.gitea.com
What should I do about it?
Upgrade to Gitea 28.3.0 or later, which contains the fix.Source: github.com, blog.gitea.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data