{"id":"CVE-2026-119625","kind":"vulnerability","aliases":["CVE-2026-119625"],"related":[],"title":"Personal access tokens bypass scope checks on the user profile route","description":"The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.","summary":"A personal access token with a narrow scope, such as read:issue, can be used over HTTP Basic auth on the /{username} route to read the owner's private activity and feeds. A public-only token can list private repositories and organizations, and an administrator's token exposes every account.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","personal-access-tokens","self-hosted"],"not_affected_if":["no-personal-access-tokens"],"how_to_check":null,"fix":"Move to a release that restricts tokens on this route to feeds (read:user or read:organization); the sources do not name a fixed version.","status":"open","published_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:34+00:00","triaged_at":"2026-11-01T10:51:23+00:00","updated_at":"2026-11-01T10:51:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-01T10:51:23Z","model":"claude-haiku-5-5","output":{"fix":"Move to a release that restricts tokens on this route to feeds (read:user or read:organization); the sources do not name a fixed version.","reach":"unknown","title":"Personal access tokens bypass scope checks on the user profile route","impact":"high","summary":"A personal access token with a narrow scope, such as read:issue, can be used over HTTP Basic auth on the /{username} route to read the owner's private activity and feeds. A public-only token can list private repositories and organizations, and an administrator's token exposes every account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["self-hosted","personal-access-tokens"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Read private activity and private repository lists using a scoped token","analyst_note":"Identify the affected product and its fixed version from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-119625) and check how to test for exposure.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-personal-access-tokens"],"who_is_affected":"Any instance that accepts personal access tokens and serves the /{username} route is exposed, since a token can be sent with HTTP Basic auth there. An attacker needs a valid token, though any token with a narrow scope can reach private data. Instances that do not issue personal access tokens can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00111,"input_tokens":4198,"output_tokens":1380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119625':14A,17A '-2026':13A,16A 'accept':81C,166C 'access':2A,21B,28B,83C 'account':76B,162C 'activ':55B,110C,119C,124C 'administr':71B,155C 'appli':159C 'auth':44B 'authent':88C 'basic':43B,87C 'bypass':4A 'check':6A,90C 'confin':95C 'could':104C,138C 'cve':12A,15A 'everi':75B,161C 'expos':74B 'feed':57B,115C,132C,172C 'host':25B 'http':42B,86C 'issu':37B,103C 'list':64B,139C 'member':123C 'narrow':32B 'organ':68B,128C,131C,146C,179C 'owner':52B,107C,141C 'person':1A,20B,27B,82C 'personal-access-token':19B 'privat':54B,65B,109C,127C,143C,149C 'profil':10A,118C,150C 'public':60B,135C 'public-on':59B,134C 'read':36B,50B,102C,105C,175C,178C 'readm':151C 'render':148C 'repositori':66B,144C 'requir':174C 'rout':11A,48B,80C,169C 'rss/atom':114C 'scope':5A,33B,92C,99C 'self':24B 'self-host':23B 'site':154C 'tab':120C 'token':3A,22B,29B,62B,73B,84C,94C,137C,157C,163C 'unrel':98C 'use':40B 'user':9A,113C,176C 'usernam':47B,78C 'web':79C 'without':89C","nicknames":[],"mitigations":[],"who_affected":"Any instance that accepts personal access tokens and serves the /{username} route is exposed, since a token can be sent with HTTP Basic auth there. An attacker needs a valid token, though any token with a narrow scope can reach private data. Instances that do not issue personal access tokens can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119625","severity":null,"published_at":"2026-11-01T10:18:36+00:00","modified_at":"2026-11-01T10:18:37+00:00","first_seen_at":"2026-11-01T10:49:34+00:00","fetched_at":"2026-11-01T10:49:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}