Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2026-119627VulnerabilityPublished

Gitea limited-visibility profile disclosure with public-only tokens

Gitea 1.27.0 through 1.27.3 is exposed to holders of public-only personal access tokens sent via HTTP Basic authentication. The fix is in Gitea 28.3.0.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Published
Last modified
Published
Not listed in CISA KEV
8/100 · provisional
Specific setups only
Fix
Fixed in 28.3.0
None on Exploit-DB, Metasploit or GitHub

Summary

Gitea, a self-hosted Git service, is affected: its web profile and RSS/Atom feed pages can be read by someone using a public-only access token, even for users and organizations whose visibility is limited. An attacker holding such a token could see the existence, profile details, and public activity of those hidden accounts, though they could not modify anything.

Read the original description

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.

What to do

  • Check whether your setup matches what the bug needs.

    Affected Gitea versions 1.27.0 through 1.27.3 (per the advisory's confirmed range; the header lists <= 28.2.0) Attacker holds a personal access token scoped as public-only, sent via HTTP Basic authentication Default configuration is affected, with RSS/Atom feeds enabled by default

  • Upgrade to a fixed version: 28.3.0.

  • Workaround: Disable Basic authentication on web routes, or disable RSS/Atom feeds (EnableFeed = false); both reduce functionality for legitimate users

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • gitea.dev

    fixed in 28.3.0

Evidence 7

  1. Advisory
  2. Patch
  3. Patch
  4. Patch
  5. Patch
  6. Repository
  7. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about CVE-2026-119627

What does this mean?

A holder of a public-only personal access token can read the profile, activity feed and metadata of limited-visibility users and organizations. This includes their existence, display name, description, public repository names and activity history, which anonymous visitors cannot see.Source: github.com, blog.gitea.com

Am I affected, and how do I check?

The confirmed affected range is Gitea 1.27.0 through 1.27.3, and the default configuration is affected, with RSS/Atom feeds enabled by default. The advisory header lists versions up to 28.2.0, so the confirmed range is the one to check against the installed version. Whether Basic authentication is used on web routes and whether feeds are enabled (EnableFeed) are the settings to look at.Source: github.com, blog.gitea.com

What should I do about it?

Upgrade to Gitea 28.3.0, which contains the fix.Source: github.com, blog.gitea.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data