What is the CVSS score of CVE-2026-58417?

CVE-2026-58417 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-58417?

Within 24 hours, identify all Gitea deployments and their current versions; consult the Gitea security advisory and GHSA-jr5x-6h83-wrxf to locate the patched version. Within 7 days, stage and deploy the patched release to all instances, validating that dependent tools and API integrations continue functioning correctly. Within 30 days, audit which users and service accounts hold active API tokens, review logs for unauthorized organization membership enumeration attempts, and restrict API scopes to minimum necessary permissions.

Gitea CVE-2026-58417

EUVD-2026-58152 HIGH

Information Exposure (CWE-200)

2026-07-21 https://github.com/go-gitea/gitea

GHSA-jr5x-6h83-wrxf

Information Disclosure Gitea

7.5

CVSS 3.1 · Vendor: https://github.com/go-gitea/gitea

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to Gitea instance with any valid API token
Delivery

Identify target private organization name (via guessing or prior knowledge)
Exploit

Query `GET /api/v1/orgs/{org}/public_members/{username}` with candidate usernames
Execution

HTTP 204 confirms membership in hidden organization
Impact

Enumerate further usernames to map private org membership

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a valid Gitea API access token belonging to any registered user account on the target instance. The target organization must be configured with 'private' visibility. Additionally, at least one member of that private organization must have explicitly set their membership to 'public/visible' within the organization - members with hidden membership cannot be confirmed via this endpoint regardless of the vulnerability. Whether truly unauthenticated access (no token) also exposes the endpoint is not definitively confirmed from available data: the CVSS PR:N metric asserts this, but the PoC exclusively demonstrates authenticated access. Exploitation is bounded entirely to information disclosure; no write operations, code execution, or availability impact are possible. The vulnerability does not affect public organizations, where membership is already disclosed by design.
Impact	The NVD-assigned CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N warrants scrutiny: the PR:N metric asserts no privileges are required, but the documented PoC explicitly uses an authenticated API token for 'user2'. If the endpoint is also reachable without authentication, PR:N is correct; if authentication is always required, PR:L would reduce the base score to approximately 6.5 (Medium). This discrepancy is unresolved in available data and should be verified against the Gitea 1.26.x API authentication model. EPSS at 0.16% (5th percentile) strongly indicates this has not been broadly exploited in the wild, and the vulnerability is absent from CISA KEV. The real-world impact is a single boolean data point per query - whether a named user belongs to a named private organization - with no integrity or availability consequence. Organizations running private Gitea instances where organizational membership is a confidential business relationship (e.g., contractor affiliations, project team compositions) face the most meaningful exposure. This is operationally lower priority than the CVSS headline suggests given low EPSS, no KEV listing, and narrow informational scope.
Exploit ScenarioDerived	An attacker with any valid Gitea account and API token queries `GET /api/v1/orgs/{org}/public_members/{username}` against a target private organization, iterating over known or guessed usernames. A 204 response confirms membership in the private organization; a 404 indicates no match. The attacker can systematically map the membership of organizations that are hidden from their web UI view, revealing confidential team compositions or contractor affiliations. A working curl-based PoC is published in GHSA-jr5x-6h83-wrxf.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Aug 14, 2026

Gitea's REST API leaks private organization membership through the GET /orgs/{org}/public_members/{username} endpoint, bypassing the visibility controls that correctly conceal this information in the web UI. All versions up to and including 1.26.4 are affected, permitting any user with a valid API token to confirm whether a specific user belongs to a hidden organization - data intentionally withheld from the web interface. No public exploit is confirmed in CISA KEV, though a detailed proof-of-concept with curl commands is documented in GHSA-jr5x-6h83-wrxf; EPSS stands at 0.16% (5th percentile), indicating low observed exploitation probability.

Earlier versions of this analysis (2)

v2 Aug 14, 2026 - 18:47 cvss changed CVSS 7.5

Gitea's REST API endpoint GET /orgs/{org}/public_members/{username} leaks private organization membership to any authenticated API user, bypassing the visibility controls enforced by the web interface. All Gitea instances running version 1.26.4 and earlier with privately-configured organizations are affected. Any authenticated API user can confirm whether a specific user belongs to a private organization, even when that organization's membership is intentionally hidden from the public profile page. No public exploit is confirmed by CISA KEV, but a detailed proof-of-concept is publicly documented in the GitHub Security Advisory GHSA-jr5x-6h83-wrxf, making exploitation straightforward for any authenticated actor.

v1 Jul 21, 2026 - 21:18

Gitea's REST API leaks organization membership for private organizations through the GET /orgs/{org}/public_members/{username} endpoint, allowing any authenticated API user to enumerate whether a specific user belongs to a private organization. Affected versions are all releases prior to 1.27.0. The vulnerability bypasses the privacy controls enforced by the web interface, where private organization membership is intentionally hidden from non-members. No public exploit identified at time of analysis, though a detailed proof-of-concept is included in the GitHub security advisory GHSA-jr5x-6h83-wrxf.

RemediationAI

Upgrade to Gitea 1.27.0, which resolves this issue via commit 685b62c60fc595e3612a85f0895471876db56292, merged in pull request https://github.com/go-gitea/gitea/pull/38145; the release is documented at https://blog.gitea.com/gitea-1.27.0-is-released/ and the advisory at https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf. For installations that cannot immediately upgrade, two compensating controls are available: first, block or rate-limit access to the API path pattern /api/v1/orgs/*/public_members* at a reverse proxy or WAF layer - this eliminates the leak but also disables legitimate public member lookups for all clients; second, audit every private organization and set all member visibility to hidden (non-public), ensuring no members have publicized their membership within private organizations - this removes the data the endpoint would disclose, but requires per-organization auditing and ongoing policy enforcement. Neither workaround substitutes for patching, and both carry operational trade-offs for legitimate use of the public member feature.

Affected VersionsENISA

Gitea Open Source Git Server 0 ≤1.26.4

Affected Packages

go gitea.dev fix: 1.27.0

euvd gitea_open_source_git_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Gitea is a self-hosted Git service written in Go (CPE: pkg:go/gitea.dev). The vulnerability originates in routers/api/v1/org/member.go, where both the ListPublicMembers and IsPublicMember API handlers were missing a call to HasOrgOrUserVisible() before processing requests. This function gates visibility of an organization based on its privacy setting and the requesting user's relationship to it. Without this check, the handlers responded to any authenticated request - returning HTTP 204 to confirm membership - regardless of whether the organization was configured as private. The web application correctly hides private organization membership on user profile pages, making this an API-layer access control gap. CWE-200 (Exposure of Sensitive Information to Unauthorized Actor) applies: the system possessed the correct logic to restrict disclosure but failed to invoke it consistently across API and web surfaces. The patch (PR #38145, commit 685b62c) adds the HasOrgOrUserVisible gate to both handlers, returning HTTP 404 rather than 204 when the requesting user lacks visibility into the organization, treating the organization's existence itself as non-disclosable.

Know when Gitea gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/go-gitea/gitea) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 6.5 MEDIUM

PoC requires an authenticated API token (PR:L); pure information disclosure with no integrity or availability impact (I:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat 4.3 MEDIUM

Primary rating from Vendor (https://github.com/go-gitea/gitea).

CVSS VectorVendor: https://github.com/go-gitea/gitea

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 14, 2026 - 18:49 vuln.today

v3 - CVSS changed

Analysis Updated

Aug 14, 2026 - 18:47 vuln.today

v2 - CVSS changed

CVSS changed

Aug 14, 2026 - 18:22 NVD

7.5 (HIGH)

DescriptionCVE.org

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

Spin up the nightly container of Gitea.
Perform the default installation.
Register a new user (let's call this user "user1").
Create a new organization with "private" visibility. We will refer to this organization as "user1org".
Make the user "user1" inside the organization visible.
Log out and register a new user ("user2").
Create an access token for "user2" with full access to the API.
Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token <user2-token>'

You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

Executive ViewAI

Why It Matters

Gitea's REST API unintentionally exposes confidential organization membership through API tokens, information the web interface correctly conceals. This creates privacy risks and potential competitive intelligence exposure for organizations managing sensitive team structures. Patches are available; remediation is straightforward but should be prioritized given the confidentiality sensitivity of organizational relationships.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Medium

popular self-hosted Git platform in developer and enterprise environments

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS GHSA Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.