Live › vulnerability › CVE-2026-119625
A personal access token with a narrow scope, such as read:issue, can be used over HTTP Basic auth on the /{username} route to read the owner's private activity and feeds. A public-only token can list private repositories and organizations, and an administrator's token exposes every account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Any instance that accepts personal access tokens and serves the /{username} route is exposed, since a token can be sent with HTTP Basic auth there. An attacker needs a valid token, though any token with a narrow scope can reach private data. Instances that do not issue personal access tokens can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Move to a release that restricts tokens on this route to feeds (read:user or read:organization); the sources do not name a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The /{username} web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require read:user or read:organization.
This page as .md · .json · in your agent: get_signal("CVE-2026-119625")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.