CVE-2026-114199

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

EUVD-2026-114793

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-114199: Gitea: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner…

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

PT-2026-134869

GET /api/v1/users/username/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-67577

An authenticated account marked restricted can read the activity feed and contribution heatmap of a Limited-visibility user through "GET /api/v1/users/username/activities/feeds" and "GET /api/v1/users/username/heatmap". The ordinary user-information endpoint and the web/RSS profile routes correct...