`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 01 Nov 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users. | |
| Title | Gitea contribution heatmap private activity disclosure to public-only tokens | |
| Weaknesses | CWE-200 CWE-203 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-01T09:48:33.765Z
Reserved: 2026-11-01T08:48:41.170Z
Link: CVE-2026-114199
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-01T10:18:34.710
Modified: 2026-11-01T10:18:34.833
Link: CVE-2026-114199
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-01T11:30:06Z