CVE-2026-97626 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, especially those with public or restricted user profiles, should assess exposure and prioritize patching. This includes administrators, security teams, and IT personnel who manage Gitea instances and are responsible for ensuring the security and integrity of the data stored within them.

Why it matters

Defenders should prioritize verifying and applying patches for Gitea instances, especially those with public or restricted user profiles, to prevent potential exploitation and unauthorized information disclosure.

• Verify and apply patches to prevent potential exploitation
• Restrict profile access to prevent unauthorized information disclosure
• Monitor instance logs for potential exploitation attempts

Technical summary

The vulnerability allows anonymous users, restricted users, and non-members to confirm the existence of limited or private users and private organizations and read their profile details and public activity by requesting a user or organization profile page with an Accept: application/rss+xml or Accept: application/atom+xml header. This issue affects Gitea instances with public or restricted user profiles, especially when `[other] ENABLE_FEED` is disabled. The vulnerability was publicly disclosed on 2026-10-06T21:36:48.056Z.

Defensive priority

Defenders should prioritize verifying and applying patches for Gitea instances, especially those with public or restricted user profiles.

Recommended defensive actions

• Verify and apply patches for Gitea instances
• Review and update Gitea configurations to restrict profile access
• Monitor Gitea instance logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability was publicly disclosed on 2026-10-06T21:36:48.056Z. The source item and CVE record do not provide specific information on the exploitation of this vulnerability. However, defenders should verify and apply patches for Gitea instances, especially those with public or restricted user profiles, to prevent potential exploitation and unauthorized information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.