{"action":"Upgrade kallithea to 0.2 or later.","affected":[{"fixed":"0.2","introduced":"0"}],"component":"kallithea","cve_ids":["CVE-2015-0260"],"ecosystem":"PyPI","epss":0.01822,"exploited":false,"fixed_versions":["0.2"],"ghsa_id":"GHSA-hhx9-4vw2-x54r","id":"tcs_01M5KG6NER50CA6Z7ZM9KX2ZXF","modified_at":"2026-06-10T17:01:22.267266347Z","published_at":"2015-02-16T15:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2015-29","https://kallithea-scm.org/security/cve-2015-0260.html","http://www.securityfocus.com/bid/72573","http://seclists.org/oss-sec/2015/q1/505","https://rhodecode.com/blog/rhodecode-enterprise-security-release/","https://exchange.xforce.ibmcloud.com/vulnerabilities/100888","https://github.com/advisories/GHSA-hhx9-4vw2-x54r"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2015-29","url":"https://osv.dev/vulnerability/PYSEC-2015-29"}],"summary":"RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method."}