EUVD-2026-41622
GHSA-37w2-86g3-h4qh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Improper access control in Gitea's organization permission API (all releases before 1.25.5) lets an authenticated API caller query permission and membership details for hidden organization members and private organizations they should not be able to see. The root cause is a visibility check performed against the target user instead of the requesting user, disclosing metadata that reveals otherwise-concealed org membership and permission levels. This is an information-disclosure/access-control issue (CWE-284) with no public exploit identified at time of analysis, a low EPSS (0.16%, 5th percentile), and SSVC exploitation status of 'none'.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
Lifecycle Timeline
2DescriptionCVE.org
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
Executive ViewAI
Gitea deployments running versions prior to 1.25.5 contain an access control flaw in the organization permissions API that allows authenticated users to query hidden organizational membership and private organization details they should not be able to access. This information disclosure vulnerability exposes sensitive governance and organizational structure data, creating compliance exposure and enabling internal reconnaissance by employees or attackers with compromised credentials.
Within 24 hours, identify all Gitea instances in your environment and document their current versions to determine exposure scope. Within 7 days, apply vendor-released patch Gitea 1.25.5 or later to all affected instances. Within 30 days, audit API access logs for the organization permission endpoints to identify any unauthorized queries to organization and membership data and assess whether sensitive organizational structures were accessed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Exploit-DB