Live › vulnerability › CVE-2026-119627
Web profile and RSS/Atom feed routes check only whether a viewer can see a limited-visibility user or organization, ignoring the public-only scope of the access token used. A holder of a public-only token can read the profile and public activity of users and organizations that are otherwise hidden from anonymous visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Teams running a self-hosted or hosted instance that has limited-visibility users or organizations and issues public-only personal access tokens. The exposure is read-only: existence, profile metadata and public activity, not write access. Instances without limited-visibility accounts, or where tokens are not issued to untrusted users, are less exposed. The sources do not name the affected product or versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.
This page as .md · .json · in your agent: get_signal("CVE-2026-119627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.