CVE-2026-119627 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, particularly those with limited-visibility users and organizations, should assess exposure and take necessary actions to restrict public-only token use and monitor for suspicious activity. Defenders should prioritize verifying exposure of limited-visibility users and organizations using public-only tokens and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-119627 allows users with public-only tokens to access profiles and feeds of limited-visibility users and organizations in Gitea, potentially leading to unauthorized information disclosure.

• Potential unauthorized access to sensitive profile and activity feed information
• Possible misuse of public-only tokens to gather information about limited-visibility users and organizations
• Need for verification of exposure and restriction of public-only token use

Technical summary

A vulnerability in Gitea allows users with public-only tokens to read profiles and activity feeds of limited-visibility users and organizations. The vulnerability affects Gitea instances with limited-visibility users and organizations. Defenders should assess exposure and take necessary actions to restrict public-only token use and monitor for suspicious activity. The disclosure covers existence, profile metadata, and public activity but does not grant write access. The vulnerability has a CVSS score of null and a CVSS severity of null.

Defensive priority

Defenders should prioritize verifying exposure of limited-visibility users and organizations using public-only tokens.

Recommended defensive actions

• Verify exposure of limited-visibility users and organizations using public-only tokens
• Restrict use of public-only tokens to necessary systems and personnel
• Monitor for suspicious activity related to profile and feed access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited to the existence of the issue and its potential impact. The vulnerability affects Gitea instances with limited-visibility users and organizations. Defenders should verify exposure and restrict public-only token use to necessary systems and personnel. The CVE record was published on 2026-11-01T10:18:37.073Z and has not been modified since then. The NVD entry provides additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.