{"id":"CVE-2026-110324","kind":"vulnerability","aliases":["CVE-2026-110324"],"related":[],"title":"Gitea: private profile details leak to any signed-in user via follow","description":"The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.","summary":"Gitea checked profile visibility only on GET requests, while POST /{username} (follow and unfollow) accepted any signed-in user. An authenticated user can read the full name, location, website and description of a user whose profile is private.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-hosting","gitea","runtime","self-hosted"],"not_affected_if":["no-private-profiles","patched-version"],"how_to_check":"- Check the Gitea version with `gitea --version` or the running binary; versions below `28.1.0` are affected.\n- Confirm whether private profiles are in use for users on the instance.","fix":"- Upgrade Gitea to `28.1.0` or later; the sources say the fix shipped in `28.1.0` and was disclosed with `28.2.0`.","status":"open","published_at":"2026-10-18T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:28+00:00","updated_at":"2026-10-25T03:57:28+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-25T03:57:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gitea to `28.1.0` or later; the sources say the fix shipped in `28.1.0` and was disclosed with `28.2.0`.","reach":"internet","title":"Gitea: private profile details leak to any signed-in user via follow","impact":"low","summary":"Gitea checked profile visibility only on GET requests, while POST /{username} (follow and unfollow) accepted any signed-in user. An authenticated user can read the full name, location, website and description of a user whose profile is private.","category":"runtime","nicknames":[],"who_cares":["gitea","self-hosted","git-hosting"],"confidence":0.75,"needs_auth":"yes","worst_case":"Authenticated users read private profile fields of other accounts","analyst_note":"","how_to_check":"- Check the Gitea version with `gitea --version` or the running binary; versions below `28.1.0` are affected.\n- Confirm whether private profiles are in use for users on the instance.","needs_analyst":false,"not_affected_if":["patched-version","no-private-profiles"],"who_is_affected":"Self-hosted or managed Gitea instances where users set profiles to private and where any account can sign in, including open registration. Instances with only trusted, fully visible profiles or no self-registration have less exposure. The sources do not give more detail on which configurations are most exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000581,"input_tokens":3332,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110324':16A,19A '-2026':15A,18A '28.1.0':121C '28.2.0':125C 'accept':42B 'appli':75C 'authent':49B,94C 'check':29B,69C 'could':96C 'cve':14A,17A 'descript':59B,105C 'detail':4A 'disclos':123C 'fix':119C 'follow':13A,39B,83C 'full':54B,100C 'get':34B,77C 'git':21B 'git-host':20B 'gitea':1A,23B,28B,71C 'host':22B,27B 'issu':117C 'leak':5A 'locat':56B,102C 'name':55B,101C 'obtain':98C 'post':37B,81C 'privat':2A,66B,111C 'profil':3A,30B,64B,73C,112C 'read':52B 'request':35B,78C 'requir':86C 'respons':115C 'runtim':24B 'self':26B 'self-host':25B 'sign':9A,45B,90C 'signed-in':8A,44B,89C 'therefor':97C 'unfollow':41B,85C 'user':11A,47B,50B,62B,72C,92C,95C,108C 'usernam':38B,82C 'via':12A 'visibl':31B,68C 'websit':57B,103C 'whose':63B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Gitea instances where users set profiles to private and where any account can sign in, including open registration. Instances with only trusted, fully visible profiles or no self-registration have less exposure. The sources do not give more detail on which configurations are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110324","severity":null,"published_at":"2026-10-18T19:16:33+00:00","modified_at":"2026-10-19T21:17:05+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}