CVE-2026-67577

4.3 MEDIUMpublic exploit available

Published 2026-10-14 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-284

Public exploit & PoC references

https://github.com/go-gitea/gitea/pull/39004
https://github.com/go-gitea/gitea/pull/39039
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-rfm6-r2x5-cg56

All references

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39004
https://github.com/go-gitea/gitea/pull/39039
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-rfm6-r2x5-cg56

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2023-54412PoC
CRITICALCVE-2024-34320
HIGHCVE-2025-70962PoC
HIGHCVE-2026-100114
HIGHCVE-2026-100115
MEDIUMCVE-2026-100621PoC
CRITICALCVE-2026-100758
MEDIUMCVE-2026-100883PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.