Gitea does not apply the privacy visibility check to POST /{username} requests, which are used for following and unfollowing a user. As a result, any authenticated user can receive the full name, location, website, and description fields of a private profile in the response payload. This flaw enables a personal data breach across the platform, compromising the privacy of users who set their profiles to private.

The vulnerability affects installations of Gitea prior to version 28.1.0, including the 26.x, 27.x, and 28.0.x releases. The issue was fixed in 28.1.0 and the patched release appears again in v28.2.0. Any system running a vulnerable version of Gitea and allowing authenticated POST requests to /{username} is exposed.

The flaw requires the attacker to be an authenticated user, limiting the attack surface to legitimate users of the instance. No public exploits or active exploitation data are reported, and the vulnerability is not listed in KEV. The EPSS score is not available, but the potential to reveal personal user information imposes a moderate privacy risk. An attacker could leverage the disclosed data for targeted phishing or social engineering, but cannot gain further privileges or system access from the flaw alone.