CVE-2026-67577

Deferred Deferred - Pending Action

Activity Feed Exposure in Gitea

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-67577

EUVD

EUVD-2026-101090

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows restricted users to access activity feeds and contribution heatmaps of users with limited-visibility profiles through specific API endpoints. The issue occurs because these API handlers do not enforce the same visibility restrictions as other profile-related endpoints.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version earlier than 1.27.3. Use commands like 'gitea --version' or check the version in the web interface. Verify if restricted users can access activity feeds or contribution heatmaps of limited-visibility users via API endpoints such as /api/v1/users/{username}/activity and /api/v1/users/{username}/heatmap.

Test by authenticating as a restricted user and attempting to access these endpoints. If data is returned, the system is vulnerable.

Impact Analysis

An attacker with restricted access could view sensitive data such as repository names, commit messages, issue or pull request events, and contribution timestamps for limited-visibility users with public repository activity. This exposes private activity despite profile restrictions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive user activity data (e.g., repository names, commit messages, issue events) through API endpoints to unauthorized restricted users. Unauthorized access to such data may violate confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. This version includes the fix for the visibility check in API handlers. No workarounds are available, so upgrading is the only mitigation.

Hi! I’m here to help you understand CVE-2026-67577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70