CVE-2026-119627
Description
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.
Is your site exposed to CVE-2026-119627?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-119627? +
How do I check if I'm vulnerable to CVE-2026-119627? +
Related Vulnerabilities
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain …
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially …
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, …
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced …
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, …