Live › vulnerability › CVE-2026-110324
Go to dashboardGitea checked profile visibility only on GET requests, while POST /{username} (follow and unfollow) accepted any signed-in user. An authenticated user can read the full name, location, website and description of a user whose profile is private.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Gitea instances where users set profiles to private and where any account can sign in, including open registration. Instances with only trusted, fully visible profiles or no self-registration have less exposure. The sources do not give more detail on which configurations are most exposed.
No product ranges from the sources yet.
gitea --version or the running binary; versions below 28.1.0 are affected.28.1.0 or later; the sources say the fix shipped in 28.1.0 and was disclosed with 28.2.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-110324")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.