VDB
CVE-2026-67577
CVE-2026-67577
PUBLISHED
CVSS 4.3 MEDIUM
Reported by Gitea · Published October 14, 2026
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-rfm6-r2x5-cg56 vendor-advisory
- Gitea 1.27.3 release announcement release-notes
- Fix: go-gitea/gitea pull request #39004 patch
- Fix: go-gitea/gitea pull request #39039 patch
- go-gitea/gitea v1.27.3 release release-notes