CVE-2026-119627
Description
A flaw was found in Gitea. An authenticated user possessing a restricted, public-only personal access token can bypass visibility controls when requesting user or organization web profiles and feed routes. This issue leads to information disclosure by allowing unauthorized viewers to access the profile details and activity feeds of limited-visibility accounts.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires an authenticated account with a valid personal access token and only exposes non-sensitive account metadata and activity streams without compromising repository source code or granting modification capabilities. In Red Hat ecosystems where Gitea dependencies are packaged within automation pipelines like Konflux and Pipelines as Code, instances typically operate within internal, trusted boundaries rather than serving arbitrary untrusted multi-tenant communities. Consequently, the practical risk to enterprise deployments remains limited.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
