The flaw in Gitea’s activity‑feed and contribution‑heatmap API handlers fails to enforce the same profile visibility restrictions applied to the web UI for restricted accounts. A restricted user can therefore request activity lists and timestamp data that are otherwise denied on the profile endpoints, potentially exposing repository names, commit messages and pull request or issue events. This disclosure leaks user activity and repository details that should remain private to certain audience groups.

The Gitea platform is affected by this vulnerability. The advisory does not specify a version range; therefore, all deployments of Gitea that have not yet applied the 1.27.3 fix are potentially vulnerable.

With a CVSS score of 4.3 the vulnerability is considered of moderate severity, but it is currently unlikely to be actively exploited as the EPSS score is below 1% and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication as a restricted user; an attacker must create or compromise such an account before being able to use the exposed API endpoints. Once authenticated, the attacker can gather the unauthorized activity reports, leading to privacy concerns for legitimate users and repositories.