CVE-2026-110324
CVE-2026-110324 · Gitea private profile information disclosure through POST request
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
CVSS 6.5 · Mittel · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
gitea
- Softwareversionen
- ≥ 1.22.0, ≤ 28.0.0: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh
- https://github.com/go-gitea/gitea/pull/39501
- https://github.com/go-gitea/gitea/pull/39507
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-110324