CVE-2026-97626
N/A
N/A
Summary
Requesting a user or organization profile page (GET /{username}) with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when [other] ENABLE_FEED was disabled. Activity in private repositories was not included.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Gitea | Gitea | 0 <= 28.0.0 | affected |
Weaknesses
- CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-863: CWE-863: Incorrect Authorization
References
- https://github.com/go-gitea/gitea/security/advisories/GHSA-hf55-9cwq-2x64
- https://github.com/go-gitea/gitea/pull/39501
- https://github.com/go-gitea/gitea/pull/39507
- https://blog.gitea.com/release-of-28.1.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.1.0
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.