CVE-2026-114199
Gitea contribution heatmap private activity disclosure to public-only tokens
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
| CWE | CWE-200 CWE-203 |
| Vendor | gitea |
| Product | gitea |
| Published | Nov 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 < 28.3.0
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-jr76-w9m3-3p68 github.com: https://github.com/go-gitea/gitea/pull/39690 github.com: https://github.com/go-gitea/gitea/pull/39853 blog.gitea.com: https://blog.gitea.com/release-of-28.3.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.3.0
Credits
🔍 https://github.com/d3do-23 https://github.com/silverwind