CVE-2026-119627
Deferred Deferred - Pending Action

Unauthorized Data Exposure via Public-Only Token in GitHub

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-119627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea allows users with a public-only personal access token (PAT) to access profile and activity feed data of limited-visibility users or organizations. The web profile and RSS/Atom feed routes incorrectly treat public-only token holders as fully authenticated, bypassing intended access controls. The issue stems from the web layer not checking the token scope, unlike the API layer which enforces the restriction properly.

Detection Guidance

Check Gitea logs for unauthorized access attempts to user profiles or RSS/Atom feeds using public-only tokens. Monitor for GET requests to routes like /{username}.rss, /{username}.atom, or HTML profiles with Basic authentication headers. Verify if limited-visibility users' data is exposed despite public-only token restrictions.

Impact Analysis

An attacker with a public-only PAT could access sensitive information such as user existence, display names, descriptions, public repository names, and activity history (commits, issue interactions, stars, forks). The HTML profile may also expose additional details like starred repositories, followers, and organization memberships. Write access is not possible through this vulnerability.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive user information such as existence, profile metadata, and public activity of limited-visibility users and organizations. Unauthorized access to such data may violate principles of data minimization, purpose limitation, and security under GDPR. For HIPAA, if the exposed data includes health-related information, it could lead to breaches of protected health information (PHI) confidentiality requirements.

Mitigation Strategies

Upgrade Gitea to a version beyond 1.27.3 where the fix is implemented. Ensure the web layer enforces public-only token scope checks for limited-visibility users. Review and restrict access logs for suspicious Basic authentication requests to profile and feed routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...