Gitea API Heatmap Endpoint Information Disclosure Vulnerability (CVE-2026-114199)
Executive & SecOps Summary
SECOPS ASSESSMENTGitea versions prior to v28.3.0
An attacker holding a user's public-only token can read contribution counts and detailed 15-minute activity time buckets originating from private repositories.
Immediately upgrade Gitea instances to the patched version v28.3.0 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Gitea instance to v28.3.0 or higher as recommended by the vendor. For Docker-based deployments, use the following commands to pull and deploy the patched image:
# Docker Compose upgrade workflow
# Update the image tag to 'gitea/gitea:28.3.0' in your docker-compose.yml first
docker compose pull gitea
docker compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, you can block or restrict access to the vulnerable heatmap API endpoint using a reverse proxy such as Nginx:
# Nginx configuration to restrict access to the heatmap API
server {
listen 80;
server_name gitea.yourdomain.com;
location ~* ^/api/v1/users/[^/]+/heatmap$ {
# Restrict access to internal networks only
allow 10.0.0.0/8;
allow 192.168.0.0/16;
deny all;
proxy_pass http://localhost:3000;
}
}3. Log Audit & IoC Verification Commands
Use the following shell script to inspect Gitea access logs for potential reconnaissance or unauthorized queries targeting the heatmap endpoint:
# Scan Gitea access logs for heatmap API requests to identify potential abuse
grep -E 'GET /api/v1/users/[^/]+/heatmap' /var/log/gitea/access.log | awk '{print $1, $4, $7, $9}'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-114199) exists in Gitea's API implementation due to improper access control validation. Specifically, the GET /api/v1/users/{username}/heatmap endpoint computes the contribution heatmap using the repository access level of the token owner, while failing to respect and enforce the 'public-only' restriction associated with the access token.
2. Exploitation Mechanics & Attack Scenario
Unlike standard activity feed endpoints that correctly filter out private repository events when queried with a public-only token, the vulnerable heatmap endpoint bypasses this restriction. An attacker possessing a public-only token of a target user can query this endpoint to extract sensitive metadata, including the exact contribution counts and their corresponding 15-minute time buckets from the user's private repository activities. Although repository names and actual source code contents are not disclosed, this leaks critical behavioral and activity patterns.
3. Infrastructure & Business Impact
In enterprise environments, developer commit frequencies and active working hours on private repositories constitute sensitive business intelligence. Competitors or malicious actors could exploit this metadata to infer release cycles, active development phases of unannounced products, or organizational work patterns, leading to compliance and intellectual property exposure.
Official Vendor Advisories & References
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.
Frequently Asked SecOps Questions (CVE-2026-114199)
FAQQ1. How critical is CVE-2026-114199 and is it actively exploited in the wild?
CVE-2026-114199 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-114199?
Primary impacted vendors include gitea across gitea. Scope summary: All Gitea versions prior to v28.3.0 (Fixed in v28.3.0)
Q3. What temporary mitigations or workarounds exist for CVE-2026-114199 before patching?
[Mitigation] Immediately upgrade Gitea instances to the patched version v28.3.0 or later. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-114199
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gitea)
View Category →Gitea Actions Task Token Authorization Bypass Leading to Private Repository Metadata Disclosure (CVE-2026-112887)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
Gitea Remote Code Execution Vulnerability via diffpatch API and Git Hooks (CVE-2026-60004)
[Affected Scope] Gitea versions prior to 1.27.1
Gitea Actions Artifact Upload Stored Cross-Site Scripting (XSS) and CSP Bypass Vulnerability (CVE-2026-113429)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.