CVE-2026-97626: Gitea

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.

Affected products

• Gitea Gitea: up to and including 28.0.0

Published 2026-10-06. Last modified 2026-10-07.