CVE-2026-114199

A flaw was found in Gitea. An authenticated user possessing a restricted, public-only access token can trigger an information disclosure vulnerability by querying the user contribution heatmap API endpoint. Due to improper enforcement of token scope restrictions, the endpoint computes activity da...