medium

CVE-2026-58427

Go · gitea.dev

Summary

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Severity
medium
EPSS
0.5% (p40)
CWE
CWE-200, CWE-863
Also known as
GHSA-prr9-9mp4-5gp2
Published
2026-07-21
Updated
2026-07-21

Advisory details

Summary

PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.

Affected Versions

<= v1.26.4 (latest) and main branch

Root Cause

routers/api/v1/org/member.go — ListMembers():

// Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

Proof of Concept

Setup: privateorg (private), alice = member, bob = outsider

Bob lists ALL members of private org

curl -s "http://gitea/api/v1/orgs/privateorg/members"
-H "Authorization: token BOB_TOKEN"

Result: HTTP 200

[{"login":"alice","email":"alice@test.com",...}]

Expected: HTTP 404

Note

This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched.

Fix

Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.