CVE-2026-110324

Received Received - Intake

Information Disclosure in Gitea User Profiles

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-110324

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allowed any authenticated user to access private profile details of other users. The visibility check for profiles was only enforced on GET requests, while POST requests like follow/unfollow operations did not require proper visibility checks. This meant private information such as full name, location, website, and description could be exposed.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version prior to 28.1.0. Verify if private user profiles are accessible via authenticated requests to POST /{username} endpoints. Inspect server logs for unusual access patterns to user profile data.

Impact Analysis

If you use Gitea with private profiles, an attacker with an account could access your private details. This could lead to privacy breaches, exposure of personal information, or targeted attacks. The issue was fixed in version 28.1.0, so updating is critical.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR or HIPAA by exposing personal data without consent. Organizations using Gitea must ensure private profile data is protected to maintain compliance. Updating to the patched version is necessary to avoid penalties.

Mitigation Strategies

Upgrade Gitea to version 28.1.0 or later to address the visibility check issue in user profiles.

Hi! I’m here to help you understand CVE-2026-110324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70