CVE-2026-119627

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The web profile and RSS/Atom feed routes of users and organizations fail to properly validate the public-only restriction of the personal access token used for authentication. An authenticated user with a public-only token can use HTTP Basic authentication to access the profile and activity feed of limited-visibility users and organizations. This allows the disclosure of existence, profile metadata, and public activity, although it does not provide write access. These resources are normally hidden from anonymous visitors and are restricted on equivalent API routes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.