CVE-2026-67577

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-25)

CWE

CWE-284

Published

2026-10-14

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

References

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39004
• https://github.com/go-gitea/gitea/pull/39039
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-rfm6-r2x5-cg56

Check your stackJSON