PT-2026-117154 · Gitea · Gitea
CVE-2026-110324
·
Published
2026-10-18
·
Updated
2026-10-18
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea versions prior to 28.1.0
Description
The visibility check for user profiles was only enforced for GET requests. Consequently, the
POST /{username} endpoint, used for following and unfollowing users, only required the requester to be signed in. This allowed any authenticated user to retrieve the full name, location, website, and description of users who had set their profiles to private by analyzing the response.Recommendations
Update to version 28.1.0 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea