{"id":"CVE-2026-97626","title":"Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and t…","summary":"Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and t…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-863"],"vendor":"Gitea","product":"gitea.dev","affected":["gitea.dev <= 28.0.0"],"published":"2026-10-06","updated":"2026-10-07","sourceUpdated":"2026-10-07T21:17:22.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97626","references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39501","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39507","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hf55-9cwq-2x64","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"}],"tags":["nvd","cve.org"],"epss":0.00199,"epssPercentile":0.09681,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T20:01:32.598207Z"},"ingestedAt":"2026-10-06T22:23:15.973Z","slug":"CVE-2026-97626","body":"## Overview\n\nRequesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":217770,"id":"CVE-2026-97626","ts":1791406441945,"field":"cvss","old":null,"new":"4.3"},{"seq":217769,"id":"CVE-2026-97626","ts":1791406441945,"field":"severity","old":"none","new":"medium"}]}