CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility
Attackers can bypass visibility checks to read private user profiles and public activity via RSS/Atom headers, even when feeds are disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97626?
CVE-2026-97626 is a medium-severity vulnerability in Gitea, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
Which versions are affected by CVE-2026-97626?
How do I fix CVE-2026-97626?
No fix has been published for CVE-2026-97626 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-97626 being exploited?
There is no known exploitation of CVE-2026-97626 in the wild and no public exploit code.
Sources
Also known as GHSA-hf55-9cwq-2x64.