Description
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
Published: 2026-11-01
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 10:00:00 +0000

Type Values Removed Values Added
Description `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
Title Gitea contribution heatmap private activity disclosure to public-only tokens
Weaknesses CWE-200
CWE-203
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-11-01T09:48:33.765Z

Reserved: 2026-11-01T08:48:41.170Z

Link: CVE-2026-114199

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-01T10:18:34.710

Modified: 2026-11-01T10:18:34.833

Link: CVE-2026-114199

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses