Description
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
Published: 2026-10-06
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Upgrade
AI Analysis

Impact

A request to a user's or organization's profile page using an Accept header for RSS or Atom returns the activity feed without enforcing the visibility checks that normally protect profile pages. Consequently, anonymous visitors, restricted users, and non-members can confirm the existence of private accounts, read profile details, and view public activity regardless of the configured Feed feature setting. This flaw corresponds to CWE-200 and CWE-863. Private repository activity is not exposed, but the lack of a visibility check creates a clear information disclosure path.

Affected Systems

The flaw affects any Gitea installation released prior to version 28.1.0. The issue was addressed in Gitea v28.1.0 and later releases, restoring the visibility checks on the RSS/Atom endpoints.

Risk and Exploitability

An attacker needs only to send a simple HTTP GET request to a profile URL with an Accept header of application/rss+xml or application/atom+xml; no authentication is required. No widespread exploitation has been reported and the EPSS score is < 1%, but the vulnerability can be used for reconnaissance by enumerating private users and acquiring profile and public activity information. The CVSS score is 4.3, and the data exposed could assist in further attacks or planning.

Generated by OpenCVE AI on October 7, 2026 at 23:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 28.1.0 or later, which reinstates the visibility checks on RSS/Atom feed routes.
  • If immediate upgrading is not possible, set ENABLE_FEED to false in the application configuration to disable all feed generation and eliminate the exposed endpoints.
  • Restrict access to the .rss and .atom endpoints by configuring the reverse proxy or web server to allow only authenticated users with appropriate permissions, thereby preventing unauthorized retrieval of activity feeds.

Generated by OpenCVE AI on October 7, 2026 at 23:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea
Vendors & Products Gitea
Gitea gitea

Tue, 06 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
Title Gitea profile feed disclosure bypassing user visibility
Weaknesses CWE-200
CWE-863
References

Subscriptions

Gitea Gitea
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-10-07T20:01:58.662Z

Reserved: 2026-10-04T22:02:04.885Z

Link: CVE-2026-97626

cve-icon Vulnrichment

Updated: 2026-10-07T20:01:55.215Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T22:17:08.047

Modified: 2026-10-07T21:17:22.833

Link: CVE-2026-97626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T23:30:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-863

    Incorrect Authorization