CVE-2026-119625: Gitea user and organization feed token scope bypass
The /{username} web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require read:user or read:organization.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs a personal access token that belongs to the target user or, for organization activity, a token held by a member of the private organization. Before the fix, even a token restricted to an unrelated scope such as read:issue could be accepted through HTTP Basic authentication on the affected route.
Who is most exposed?
Users whose personal access tokens have limited or public-only scopes are exposed because those tokens could reveal private activity, repositories, organizations, and profile README content. A site administrator token could expose this information for every account.
What access can an improperly scoped token gain?
It can read the token owner's private activity via the user RSS/Atom feed and profile activity tab. It can also access activity of other members in a private organization through that organization's feed; public-only tokens could list the owner's private repositories and organizations and render private profile READMEs.
What behavior should be expected after the fix?
The route accepts tokens only for feeds. Feed access requires read:user or read:organization, preventing tokens limited to unrelated scopes from being used for these requests.