{"id":"CVE-2026-114199","kind":"vulnerability","aliases":["CVE-2026-114199"],"related":[],"title":"Gitea: heatmap API leaks private-repo contribution counts to public-only tokens","description":"`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.","summary":"The user heatmap API endpoint ignored the public-only restriction on access tokens and counted contributions from private repositories. A holder of a public-only token could read contribution counts and 15-minute activity buckets for a user, but not repository names or contents.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-tokens","private-repos","runtime","self-hosted"],"not_affected_if":["no-private-repos","no-public-only-tokens"],"how_to_check":null,"fix":"- For public-only tokens the heatmap now only counts activity visible to anonymous users; the fixed version is unknown","status":"open","published_at":"2026-11-01T10:18:34+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:40+00:00","updated_at":"2026-11-01T10:51:40+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-01T10:51:40Z","model":"claude-haiku-5-5","output":{"fix":"- For public-only tokens the heatmap now only counts activity visible to anonymous users; the fixed version is unknown","reach":"internet","title":"Gitea: heatmap API leaks private-repo contribution counts to public-only tokens","impact":"low","summary":"The user heatmap API endpoint ignored the public-only restriction on access tokens and counted contributions from private repositories. A holder of a public-only token could read contribution counts and 15-minute activity buckets for a user, but not repository names or contents.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["self-hosted","api-tokens","private-repos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads private contribution counts and activity timing","analyst_note":"Confirm the affected product (the sources list none) and the fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114199.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-private-repos","no-public-only-tokens"],"who_is_affected":"Self-hosted or hosted instances that expose the user heatmap endpoint and issue public-only access tokens. Exposure is limited to contribution counts and time buckets from private repositories, not repository names or contents. Instances that do not use private repositories or public-only tokens have little to worry about.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4173,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114199':17A,20A '-2026':16A,19A '/api/v1/users':78C '/heatmap':80C '15':64B,125C 'access':43B,88C,102C 'activ':66B,106C,135C,156C 'anonym':159C 'api':3A,22B,34B 'api-token':21B 'bucket':67B,128C 'comput':81C 'content':76B,142C 'contribut':8A,47B,61B,83C,121C 'could':59B,119C 'count':9A,46B,62B,122C,155C 'cve':15A,18A 'disclos':145C 'endpoint':35B,108C 'feed':107C 'get':77C 'gitea':1A 'heatmap':2A,33B,84C,152C 'holder':52B,110C 'host':30B 'ignor':36B,94C 'leak':4A 'minut':65B,126C 'name':74B,140C 'owner':92C 'privat':6A,25B,49B,137C 'private-repo':5A,24B 'public':12A,39B,56B,97C,116C,148C 'public-on':11A,38B,55B,96C,115C,147C 'read':60B,120C 'repo':7A,26B 'repositori':50B,73B,87C,138C,139C 'restrict':41B,99C 'runtim':27B 'self':29B 'self-host':28B 'stem':130C 'time':127C 'token':14A,23B,44B,58B,91C,103C,118C,150C 'unlik':104C 'user':32B,70B,113C,133C,160C 'usernam':79C 'visibl':157C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or hosted instances that expose the user heatmap endpoint and issue public-only access tokens. Exposure is limited to contribution counts and time buckets from private repositories, not repository names or contents. Instances that do not use private repositories or public-only tokens have little to worry about.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114199","severity":null,"published_at":"2026-11-01T10:18:34+00:00","modified_at":"2026-11-01T10:18:34+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}