CVE-2026-119625None▾ SunlitThe `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the us…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The /{username} web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require read:user or read:organization.
gitea.dev < 28.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119627NoneGitea limited-visibility profile disclosure with public-only tokens
CVE-2026-119441NoneGitea public-only token bypass on bulk organization repository deletion
CVE-2026-117685NoneGitea public-only package token access to private OCI blobs
CVE-2026-118394NoneGitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-116289NoneGitea public-only token bypass through Actions runner registration
CVE-2026-116474NoneGitea Actions job token spoofing of instance-signed commits