# CVE-2026-110324: Gitea user profile information disclosure via POST request

Source: https://junglewise.ai/threats/cve-2026-110324-the-visibility-check-of-gitea-user-profiles-was-applied-to-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-110324 · Severity: info · Published 2026-10-18

Gitea, a self-hosted Git service platform, disclosed user profile information to authenticated users even when a user's profile was marked as private or limited visibility. An attacker with any valid Gitea account could follow or unfollow users to extract sensitive profile fields like full name, location, website, and bio from users with restricted profile visibility.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea).

## Quick answers

**Is CVE-2026-110324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110324 being exploited in the wild.

**How severe is CVE-2026-110324?** Informational severity, published 18 October 2026.

**Which products and versions are affected?** Gitea before 28.1.0.

**Is there a fix for CVE-2026-110324?** Yes: fixed in 28.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110324 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110324?** Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 28.1.0

## Technical details

The visibility check for user profiles was only applied to GET requests but not to POST /{username} follow and unfollow endpoints. Any authenticated user could send a POST request and receive profile metadata in the response despite the target user having private or limited visibility settings. The vulnerability was patched in Gitea 28.1.0.

## Affected products

- Gitea Gitea before 28.1.0

## Timeline

- 2026-09-30: patched: Fix merged in PR #39501
- 2026-10-18: disclosed: Disclosed with Gitea 28.2.0 release

## References

- [https://blog.gitea.com/release-of-28.2.0/](https://blog.gitea.com/release-of-28.2.0/)
- [https://github.com/go-gitea/gitea/pull/39501](https://github.com/go-gitea/gitea/pull/39501)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)