CVE-2026-119625

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The /{username} web route accepted personal access tokens via HTTP Basic authentication without verifying their scope. This allowed tokens with unrelated scopes, such as read:issue, to access the owner's private activity through the profile activity tab and RSS/Atom feeds, as well as private organization activity via the organization feed. Additionally, public-only tokens could list private repositories, organizations, and render private profile READMEs. In the case of site administrator tokens, this access extended to every account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.