CVE-2026-110324
CVE-2026-110324 · Gitea private profile information disclosure through POST request
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
CVSS 6.5 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 1.22.0, ≤ 28.0.0: Affected (semver)
No fix published
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh
- https://github.com/go-gitea/gitea/pull/39501
- https://github.com/go-gitea/gitea/pull/39507
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-110324