CVE-2026-114199
Deferred Deferred - Pending Action

Heatmap Data Exposure via Public-Only Token in GitHub API

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-114199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114199 is a vulnerability in Gitea where a public-only personal access token (PAT) unintentionally exposes private repository contribution counts through the user heatmap endpoint. The heatmap endpoint ignored the public-only restriction of the token, allowing a holder of such a token to read contribution counts and their 15-minute time buckets from private repositories owned by the token holder. Repository names and contents were not disclosed.

Detection Guidance

Check Gitea logs for unauthorized access to the /api/v1/users/{username}/heatmap endpoint. Monitor for unusual requests to this API path with public-only tokens. Verify if contribution counts from private repositories are being exposed in heatmap responses.

Impact Analysis

If you use a public-only PAT in Gitea, an attacker with access to your token could view contribution counts and timestamps from your private repositories. This exposes metadata about your activity in private projects, even though the token is restricted to public data. The impact is limited to contribution counts and time buckets, not repository contents or names.

Compliance Impact

This vulnerability could impact compliance by exposing private repository activity metadata, which may violate data protection requirements under GDPR or HIPAA if such metadata is considered sensitive. Organizations using Gitea with public-only tokens should patch to prevent unauthorized access to private activity data.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later to apply the patch. Review access logs for any suspicious activity related to the heatmap endpoint. Ensure all public-only tokens are re-evaluated for proper access restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...