medium

CVE-2026-58417

Go · gitea.dev

Summary

Gitea: REST API exposes organization membership of private organizations to public

Severity
medium
EPSS
0.5% (p40)
CWE
CWE-200, CWE-863
Also known as
GHSA-jr5x-6h83-wrxf
Published
2026-07-21
Updated
2026-07-21

Advisory details

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

  1. Spin up the nightly container of Gitea.
  2. Perform the default installation.
  3. Register a new user (let's call this user "user1").
  4. Create a new organization with "private" visibility. We will refer to this organization as "user1org".
  5. Make the user "user1" inside the organization visible.
  6. Log out and register a new user ("user2").
  7. Create an access token for "user2" with full access to the API.
  8. Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET'
'http://localhost:4700/api/v1/orgs/user1org/public_members/user1'
-H 'accept: application/json'
-H 'authorization: token '

  1. You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.