Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Gitea reveals hidden activity to restricted users

CVE-2026-67577 · published 21 days ago
Summary

In Gitea, users with limited access can still pull activity data that should be hidden, such as repository names, commit messages, and issue or pull‑request events. This could let them see information they are not supposed to view. Update Gitea to the latest release or apply the provided security patch to correct the visibility checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gitea gitea <= 1.27.2
Original advisory text
Gitea restricted-user activity and heatmap disclosure
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-67577 · NVD
CVE-2026-67577 · MITRE
CVE-2026-67577 · OSV
GHSA-rfm6-r2x5-cg56 · GHSA
Track software like this
Free during beta