CVE-2026-114199— Gitea contribution heatmap private activity disclosure to public-only tokens

Quick assessment

Copy summary Copy citation

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

接口在计算贡献热力图时，依据的是令牌持有者对仓库的访问权限，却忽略了访问令牌中“仅限公开”（public-only）的限制，这与活动动态（activity feed）端点的行为不一致。因此，持有用户“仅限公开”令牌的攻击者能够读取该用户在私有仓库中产生的贡献次数及其对应的 15 分钟时间桶数据。需要注意的是，仓库名称和内容并未泄露。针对“仅限公开”令牌，该热力图现已调整为仅统计对匿名用户可见的活动。

CVE-2026-114199 affects Gitea Gitea. No confirmed in-the-wild exploitation; assess based on exposure. 接口在计算贡献热力图时，依据的是令牌持有者对仓库的访问权限，却忽略了访问令牌中“仅限公开”（public-only）的限制，这与活动动态（activity feed）端点的行为不一致。因此，持有用户“仅限公开”令牌的攻击者能够读取该用户在私有仓库中产生的贡献次数及其对应的 15 分钟时间桶数据。需要注意的是，仓库名称和内容并未泄露。针对“仅限公开”令牌，该热 CVE-2026-114199 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-114199

I. Basic Information for CVE-2026-114199

Affected Products

II. Public POCs for CVE-2026-114199

III. Intelligence Information for CVE-2026-114199

Other References for CVE-2026-114199 (5)

• https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
• https://blog.gitea.com/release-of-28.3.0/ release-notes
• https://github.com/go-gitea/gitea/pull/39690 patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-jr76-w9m3-3p68 vendor-advisory
• https://github.com/go-gitea/gitea/pull/39853 patch

• https://www.cve.org/CVERecord?id=CVE-2026-114199

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

IV. Related Vulnerabilities