CVE-2026-67577

4.3 Moyenne

Publiée le 14/10/2026 à 17:17 · Modifiée le 14/10/2026 à 18:17 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.

Traduire en français

Produits concernés

Gitea

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-284

Références

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39004
https://github.com/go-gitea/gitea/pull/39039
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-rfm6-r2x5-cg56

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories