Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
gitea:gitea
References 5
https://github.com/go-gitea/gitea/security/advisories/GHSA-hf55-9cwq-2x64
GitHub Security Advisory GHSA-hf55-9cwq-2x64
https://github.com/go-gitea/gitea/pull/39501
Fix: go-gitea/gitea pull request #39501
https://github.com/go-gitea/gitea/pull/39507
Fix backport to release/v28: go-gitea/gitea pull request #39507
https://blog.gitea.com/release-of-28.1.0/
Gitea 28.1.0 release announcement
https://github.com/go-gitea/gitea/releases/tag/v28.1.0
go-gitea/gitea v28.1.0 release