CVE-2026-114199 Gitea CVE debrief

Who should care

Gitea administrators and users with public-only tokens should assess their exposure and take steps to restrict heatmap data access. Defenders should prioritize verifying exposure of Gitea instances to public-only tokens and assess the impact of restricting heatmap data access. Users with public-only tokens should be aware of the potential for unauthorized access to private repository data and take steps to mitigate this risk.

Why it matters

CVE-2026-114199 allows users with public-only tokens to access contribution heatmap data from private repositories, requiring defenders to verify exposure and restrict access.

• Defenders must verify Gitea instances for exposure to public-only tokens
• Restricting heatmap data access is crucial to prevent unauthorized data access
• Monitoring for unusual activity related to contribution heatmap data is necessary

Technical summary

The `GET /api/v1/users/{username}/heatmap` endpoint in Gitea computed contribution heatmaps using the repository access of the token owner, ignoring public-only token restrictions. This allowed users with public-only tokens to access contribution counts and 15-minute time buckets from private repositories. The issue has been fixed in version 28.3.0, and defenders should assess their exposure and restrict heatmap data access accordingly. The fix ensures that for public-only tokens, the heatmap only counts activity visible to anonymous users, preventing unauthorized access to private repository data. Defenders should prioritize verifying exposure of Gitea instances to public-only tokens and assess the impact of

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to public-only tokens and assess the impact of restricting heatmap data access.

Recommended defensive actions

• Verify Gitea instances for exposure to public-only tokens
• Restrict heatmap data access for public-only tokens
• Monitor for unusual activity related to contribution heatmap data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while Gitea's release notes and GitHub pull requests offer additional context on the fix. The issue was caused by the incorrect application of public-only token restrictions in the heatmap computation logic. Defenders should verify Gitea instances for exposure to public-only tokens and assess the impact of restricting heatmap data access. The fix has been implemented in version 28.3.0, and users are advised to update to this version or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.