CVE-2026-110324: 
Gitea vulnerability analysis and mitigation

CVE-2026-110324 is an information disclosure vulnerability in Gitea that allows any authenticated user to retrieve private profile information — including full name, location, website, and description — from users who have configured their profiles as private. The flaw affects Gitea versions 1.22.0 through 28.0.0 and was fixed in version 28.1.0, with public disclosure occurring alongside the release of version 28.2.0 on October 18, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) lies in an incomplete access control implementation in Gitea's profile routing logic. The visibility check in routers/web/user/profile.go (lines 54–59) is only applied to HTTP GET requests for user profiles, while the POST /{username} route defined in routers/web/web.go (line 911) only requires the requester to be signed in. The ActionUserFollow handler does not verify whether the target user's profile is visible to the requester, and because the action switch statement has no default case, sending an empty or unknown action still causes the private profile header — containing personal details — to be rendered and returned in the HTTP response (GitHub Advisory, Fix PR #39501).

Successful exploitation allows any authenticated user on a Gitea instance to bypass the private profile visibility setting and read another user's full name, location, website URL, and profile description without authorization. While this does not grant access to repositories, code, or credentials, it undermines the privacy expectations of users who have explicitly opted into private profiles, potentially exposing personally identifiable information (PII) at scale across all affected Gitea instances (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires only a valid authenticated session — no elevated privileges or special permissions — making it trivially exploitable by any registered user on an affected Gitea instance. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Authenticate: Log in to any Gitea instance running a vulnerable version (1.22.0–28.0.0) with a valid user account.
2. Identify target: Determine the username of a user whose profile is set to private (e.g., by browsing public activity, commit history, or issue comments).
3. Send crafted POST request: Issue an HTTP POST request to POST /{username} with an empty or unrecognized action parameter (e.g., action= or omitting the action field entirely). Authentication cookies must be included.
4. Extract private profile data: Parse the HTTP response body, which will contain the private profile header rendered by Gitea, including the target user's full name, location, website, and description — data that would normally be hidden from non-authorized viewers (GitHub Advisory, Fix PR #39501).

• Network: Unusual volume of HTTP POST requests to POST /{username} endpoints, particularly from a single authenticated user targeting multiple different usernames in rapid succession.
• Logs: Gitea access logs showing repeated POST /{username} requests with empty or unrecognized action parameters from the same session or IP address; responses returning HTTP 200 for users with private profiles.
• Behavioral: A single authenticated account sending POST requests to profile endpoints of users with whom they have no prior interaction history.

Gitea has released a fix in version 28.1.0 (backported to the v28 release branch via PR #39507), with the vulnerability publicly disclosed alongside version 28.2.0. Administrators should upgrade to Gitea 28.1.0 or later immediately. No configuration-based workaround is available; the only remediation is upgrading to a patched version (GitHub Advisory, Fix PR #39507, Gitea v28.2.0 Release).

The vulnerability was credited to researcher Yanni8 (discovery) and bircni (analysis), with the fix authored by silverwind. The fix was part of a broader PR (#39501) that addressed multiple missing access control checks across several Gitea API and web handlers, suggesting a systematic review of handler-level authorization logic. No significant external media coverage or notable community commentary beyond the GitHub advisory and release notes has been identified (GitHub Advisory, Fix PR #39501).