Gitea CVE-2026-25714

Exploitation requires the attacker to hold a valid Gitea API token configured with the 'public only' scope (enabled via Settings > Applications by checking 'public only' during token creation). The Gitea instance must be running version 1.26.1 or earlier. The token owner must be a member of at least one private or limited-visibility organization for the information disclosure to reveal non-public data. The /api/v1/user/orgs endpoint must be network-reachable by the attacker. Exploitation is bounded by the authenticated token requirement (CVSS PR:L) - unauthenticated network access is insufficient. Impact is further limited to organization membership enumeration only; no repository content, secrets, or write capabilities are exposed. The flaw affects only tokens with the 'public only' flag set; standard scoped tokens without this flag are not affected because checkTokenPublicOnly only enforces restrictions when this flag is present.

The vendor-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the bounded impact: a low-privilege authenticated token holder can remotely enumerate private organization membership with no user interaction required. No EPSS score was provided in the available intelligence; however, attack complexity is objectively low - exploitation is a single authenticated HTTP GET call. No CISA KEV listing exists and no public exploit code has been identified, keeping real-world exploitation risk moderate. The primary concern is principle-of-least-privilege violation: users and operators who issue public-only tokens as a deliberate security boundary - for CI/CD pipelines, integrations, or third-party access - receive a false assurance of data isolation. The incomplete-fix nature amplifies concern because defenders who believed CVE-2025-68941 was fully patched may not have re-evaluated token exposure. Impact is limited to organization membership metadata enumeration only; repository content, credentials, and write access are not at risk per the description and CVSS I:N/A:N metrics.

An attacker obtains a Gitea API token that was deliberately scoped to 'public only' - for example, a CI/CD credential or a third-party integration token issued under a least-privilege model. The attacker sends a single GET request to /api/v1/user/orgs with that token as a Bearer credential; due to the missing middleware and switch-case bypass, the server responds with a full listing of all organizations the token owner belongs to, including private and limited-visibility ones. No public exploit code exists at time of analysis, but the steps-to-reproduce published in the advisory make this attack trivially replicable with standard curl commands.