CVE-2026-119625
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.
- Score
- –
- Published
- 2026-11-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| www/gitea | gitea | 28.2.0 | unaddressed | ports@foss-daily.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>gitea -- FIXME</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>28.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-119625: The `/{username}` web route accepted personal access
tokens over HTTP Basic authentication without checking their scope.
A token confined to an unrelated scope, such as `read:issue`, could
read its owner's private activity through the user RSS/Atom feed
and the profile activity tab, and other members' activity in a
private organization through the organization feed; a public-only
token could list the owner's private repositories and organizations
and render private profile READMEs. For a site administrator's
token this applied to every account. Tokens are now accepted on
this route only for feeds, which require `read:user` or
`read:organization`.</p>
</body>
</description>
<references>
<cvename>CVE-2026-119625</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-119625</url>
</references>
<dates>
<discovery>2026-11-01</discovery>
<entry>2026-11-02</entry>
</dates>
</vuln>