CVE-2026-110324: Gitea private profile information disclosure through POST request
The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 28.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Gitea user can exploit it. The affected endpoint requires the attacker to be signed in, but does not require permission to view the target user's private profile.
What information can be disclosed?
The response can expose a private-profile user's full name, location, website, and description.
Which request path triggers the disclosure?
The issue occurs through POST requests to /{username}, used for follow and unfollow actions. Profile visibility checks were applied to GET requests only.
What version fixes the issue?
The issue was fixed in Gitea 28.1.0. It was disclosed with 28.2.0.