CVE-2026-110324
CVE-2026-110324 · Gitea private profile information disclosure through POST request
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
CVSS 6.5 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
gitea
- Versiones
- ≥ 1.22.0, ≤ 28.0.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh
- https://github.com/go-gitea/gitea/pull/39501
- https://github.com/go-gitea/gitea/pull/39507
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-110324