CVE-2026-67577 Gitea CVE debrief

Who should care

Gitea instance administrators and security teams should assess exposure and apply patches or updates. They should also monitor Gitea instance activity for suspicious behavior and review compensating controls for exposed systems. Additionally, they should track exceptions, retest remediated assets, and ensure evidence is documented before closing the item.

Why it matters

Defenders should prioritize verifying exposure and applying patches for Gitea instances with restricted users to prevent unauthorized access to activity records and contribution timestamps.

• Restricted users can retrieve activity records and contribution timestamps that the corresponding profile routes deny
• Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity

Technical summary

The Gitea activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. This allows restricted users to access activity records and contribution timestamps that should be denied by the corresponding profile routes. The exposed information can include repository names, commit messages, and issue or pull request events from public repositories. Defenders should focus on verifying exposure and applying necessary patches or updates.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Gitea instances with restricted users.

Recommended defensive actions

• Verify Gitea instance exposure and restricted user configurations
• Apply patches or updates to Gitea instances
• Monitor Gitea instance activity for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the Gitea restricted-user activity and heatmap disclosure vulnerability. Evidence is limited to public sources and CVE Program records. Defenders should verify Gitea instance exposure and restricted user configurations. The CVE record was published on 2026-10-14T14:36:16.540Z and has not been modified since then. No additional evidence or details are available beyond the CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.