Live › vulnerability › CVE-2026-114199
The user heatmap API endpoint ignored the public-only restriction on access tokens and counted contributions from private repositories. A holder of a public-only token could read contribution counts and 15-minute activity buckets for a user, but not repository names or contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Self-hosted or hosted instances that expose the user heatmap endpoint and issue public-only access tokens. Exposure is limited to contribution counts and time buckets from private repositories, not repository names or contents. Instances that do not use private repositories or public-only tokens have little to worry about.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GET /api/v1/users/{username}/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
This page as .md · .json · in your agent: get_signal("CVE-2026-114199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.