{"id":"CVE-2026-119627","aliases":["EUVD-2026-114808","GHSA-5j4v-rwqr-vpq7"],"status":"published","title":"Gitea limited-visibility profile disclosure with public-only tokens","description":"The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00266,"percentile":0.18716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1220"],"published":"2026-11-01T09:48:58Z","modified":"2026-11-06T15:03:15Z","products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-5j4v-rwqr-vpq7","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/39690","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/39853","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/39945","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/40115","tags":["patch","fix"]},{"url":"https://blog.gitea.com/release-of-28.3.0/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":["release-notes","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119627.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119627","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-119627","title":"Gitea limited-visibility profile disclosure with public-only tokens","description":"The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.","status":"published","published":"2026-11-01T09:48:58.988Z","modified":"2026-11-06T15:03:15.14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1220"],"updated_at":"2026-11-06T16:58:45.944646Z"}],"euvd":[{"id":"EUVD-2026-114808","description":"The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.","status":"published","published":"2026-11-01T09:48:58Z","modified":"2026-11-06T15:03:15Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T16:05:20.373498Z"}],"nvd":[{"id":"CVE-2026-119627","description":"The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.","status":"published","published":"2026-11-01T10:18:37.073Z","modified":"2026-11-06T15:17:13.127Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1220"],"updated_at":"2026-11-06T18:00:55.423579Z"}],"osv":[{"id":"CVE-2026-119627","title":"Gitea limited-visibility profile disclosure with public-only tokens","description":"The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.","status":"published","published":"2026-11-01T09:48:58.988Z","modified":"2026-11-08T02:31:05.005921312Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1220"],"updated_at":"2026-11-07T03:08:01.41647Z"}]}}