CVE-2026-110324CWE-200information-disclosure

CVE-2026-110324

Medium · published October 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-10-18T23:16Z
References (5)
https://blog.gitea.com/release-of-28.2.0/ · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39501 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39507 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/releases/tag/v28.2.0 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh · 88ee5874-cf24-4952-aea0-31affedb7ff2
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 18 OCT 18:57Z
    Gitea private profile information disclosure through POST request
    cvelistv5
  • 18 OCT 18:57Z
    Gitea private profile information disclosure through POST request
    cvelistv5