CVE-2026-110324None▾ SunlitThe visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
gitea.dev >= 1.22.0 <= 28.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110311NoneGitea draft release creation disclosing attachment metadata
CVE-2026-97626Medium· 4.3Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and t…
CVE-2026-97204NoneGitea label deletion across repository and organization IDs
CVE-2026-109553NoneGitea SSH certificate principal impersonation of other users
CVE-2026-107618NoneGitea cross-site request forgery on repository topics
CVE-2026-105661NoneGitea panic on the repositories route of individual users