Gitea’s privacy check is applied only to GET requests for user profiles. The POST endpoint used for following and unfollowing a user, accessed as POST /{username}, requires only a signed‑in user and does not enforce the visibility restriction. Consequently, any authenticated user can trigger this endpoint and receive the full name, location, website and description fields of a private profile in the response, leaking personal data that was meant to be hidden.

Installations of Gitea running versions earlier than 28.1.0 are affected. The vulnerability was addressed in the 28.1.0 release and the patched state is present in subsequent releases, such as 28.2.0.

The flaw requires that the attacker is an authenticated user, which limits the exploit surface to legitimate account holders. No public exploits or active exploitation data are reported, and the vulnerability is not listed in CISA KEV. The EPSS score of < 1% indicates a very low yet nonzero likelihood of exploitation. With a CVSS score of 6.5 the vulnerability is considered medium severity. The disclosed data may be used for targeted phishing or social engineering but does not give the attacker additional privileges on the system.