CVE-2026-119627

The Gitea web profile and RSS/Atom feed routes are vulnerable to information disclosure due to insufficient access control. The application fails to validate the public-only restriction of a personal access token during authentication. Consequently, a user with a public-only token can use HTTP Ba...