CVE-2026-110324: Gitea Information Disclosure Vulnerability

CVE-2026-110324 Overview

CVE-2026-110324 is an information disclosure vulnerability in Gitea, a self-hosted Git service. The visibility check for user profiles was enforced only on GET requests. The POST /{username} endpoint, used for follow and unfollow actions, required only an authenticated session. Any signed-in user could invoke this endpoint against a user with a private profile and receive the full name, location, website, and description in the response. The flaw is tracked under [CWE-200] (Exposure of Sensitive Information). It was fixed in Gitea 28.1.0 and publicly disclosed with the release of 28.2.0.

Critical Impact

Authenticated attackers can enumerate sensitive profile metadata of users who explicitly configured their profiles as private, defeating the privacy control in Gitea.

Affected Products

• Gitea versions prior to 28.1.0
• Gitea self-hosted Git service instances with private profiles enabled
• Multi-tenant Gitea deployments where user privacy expectations apply

Discovery Timeline

• 2026-10-18 - CVE-2026-110324 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110324

Vulnerability Analysis

Gitea allows users to mark their profile as private so that identifying metadata is not visible to other users. The authorization logic that enforces this control was wired into the profile view handler that processes GET /{username} requests. The follow and unfollow action handler, exposed at POST /{username}, applied a different authorization policy that required only that the caller be signed in.

Because the response body for the follow action included profile fields such as full name, location, website, and description, any authenticated account could issue a POST /{username} request to retrieve those fields for a target user with a private profile. The server returned the data without evaluating the visibility setting. The flaw is a broken access control condition classified as [CWE-200] Exposure of Sensitive Information.

Root Cause

The visibility middleware was scoped to the GET route for user profiles. The POST /{username} route that implements follow and unfollow was registered against a different handler chain that enforced authentication but did not evaluate the target user's privacy preference. Fields intended to be gated by the visibility check were included in the follow response payload. The fixes are implemented in Gitea pull requests #39501 and #39507.

Attack Vector

An attacker needs a valid account on the target Gitea instance. The attacker sends a POST /{username} request against a user with a private profile to trigger a follow or unfollow operation. The server responds with a payload containing the private profile fields. The attack is scriptable and can be repeated across the user directory to harvest metadata at scale.

See the GitHub Security Advisory GHSA-xmfc-hqq8-33wh for the maintainer-authored technical description.

Detection Methods for CVE-2026-110324

Indicators of Compromise

• Unusual volume of POST /{username} requests from a single authenticated session targeting many distinct usernames
• Follow and unfollow events in Gitea audit logs that do not correspond to normal user activity patterns
• Access patterns iterating sequentially or alphabetically through the user namespace

Detection Strategies

• Parse Gitea access logs for POST requests whose path matches /{username} and group by source account to identify enumeration
• Alert when a single account triggers follow or unfollow actions above a baseline threshold within a short interval
• Correlate follow events with the privacy setting of the target account to flag access to profiles marked private

Monitoring Recommendations

• Forward Gitea web server and application logs to a centralized logging platform for retention and analytics
• Build dashboards that track follow and unfollow activity per user and per source IP
• Review authentication logs for newly created or dormant accounts that begin issuing high volumes of profile actions

How to Mitigate CVE-2026-110324

Immediate Actions Required

• Upgrade Gitea to version 28.1.0 or later, with 28.2.0 recommended as the publicly disclosed release containing the fix
• Audit application and reverse proxy logs for POST /{username} activity against private profiles since the vulnerable version was deployed
• Rotate or disable accounts that show enumeration behavior, and notify affected users whose private profile data may have been accessed

Patch Information

The issue was fixed in Gitea 28.1.0 and disclosed with 28.2.0. Reference the Gitea 28.2.0 release notes and the v28.2.0 release tag. The code changes are implemented in pull requests #39501 and #39507.

Workarounds

• Restrict Gitea instance access to trusted users only until the upgrade is applied, reducing the pool of authenticated attackers
• Place a reverse proxy or web application firewall rule in front of Gitea that rate limits POST requests to /{username} on a per-session basis
• Advise users with private profiles to remove sensitive content from the full name, location, website, and description fields until patching is complete

# Example reverse proxy rate limit for the follow endpoint (nginx)
# Review and adapt before applying in production
limit_req_zone $binary_remote_addr zone=gitea_follow:10m rate=10r/m;

location ~ ^/[^/]+$ {
    limit_except GET {
        limit_req zone=gitea_follow burst=5 nodelay;
    }
    proxy_pass http://gitea_backend;
}