CVE-2026-114199

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The endpoint GET /api/v1/users/{username}/heatmap failed to enforce the public-only restriction of access tokens. This allowed a holder of a public-only token to access contribution counts and 15-minute time buckets derived from the user's activity in private repositories, although repository names and contents remained protected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.