CVE and update status of the FreeBSD ports tree3,755 unaddressed CVEs in 720 portsAll times are CET
CVE details

CVE-2026-119627

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.

Score
–
Published
2026-11-01
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/giteagitea28.2.0unaddressedports@foss-daily.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>gitea -- FIXME</topic>
    <affects>
      <package>
	<name>gitea</name>
	<range><lt>28.3.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-119627: The web profile and RSS/Atom feed routes of users and
	  organizations checked only whether a signed-in viewer could see a
	  limited-visibility owner, without considering the `public-only`
	  restriction of the personal access token used to authenticate. Any
	  user holding a public-only token could send it over HTTP Basic
	  authentication to read the profile and activity feed of limited-
	  visibility users and organizations, which are hidden from anonymous
	  visitors and refused on the equivalent API routes. The disclosure
	  covers existence, profile metadata and public activity; it does not
	  grant write access.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-119627</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-119627</url>
    </references>
    <dates>
      <discovery>2026-11-01</discovery>
      <entry>2026-11-02</entry>
    </dates>
  </vuln>