A request to the heatmap API endpoint performed computations using the accessing token’s permissions, ignoring the public‑only restriction applied to the token. This allowed a holder of a public‑only token to retrieve contribution counts and 15‑minute time buckets that reflected the target’s activity in private repositories, while not revealing repository names or contents. The exposed data can give an attacker a detailed activity pattern and timing of a user’s private work, which is a privacy breach and potentially useful for targeted attacks.

All installations of Gitea before the 28.3.0 release are affected. The vulnerability is present in any deployment where the heatmap endpoint uses the token’s full access level without filtering for public visibility, regardless of the token’s declared scope.

The exploit is trivial for anyone who possesses a public‑only token: they can call the public heatmap endpoint, receive the private activity metadata, and use it for reconnaissance. The EPSS score is unavailable, and the flaw is not listed in CISA’s KEV catalog, but the impact level is moderate to high owing to the privacy implications. No special prerequisites beyond the token are required, and no authentication beyond the token is necessary. The flaw is narrowly scoped to exposure of activity data and does not affect repository contents.