Is there a patch available for CVE-2026-58417?

Yes, a patch is available for CVE-2026-58417. Update the affected software to the latest version immediately.

Gitea CVE-2026-58417

MEDIUM

Information Exposure (CWE-200)

2026-07-21 https://github.com/go-gitea/gitea

GHSA-jr5x-6h83-wrxf

Information Disclosure Gitea

Severity by source

vuln.today AI

4.3 MEDIUM

Network-accessible API requires low-privilege authentication; only confidentiality is impacted (membership status), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 21, 2026 - 21:18 vuln.today

Analysis Generated

Jul 21, 2026 - 21:18 vuln.today

DescriptionCVE.org

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

Spin up the nightly container of Gitea.
Perform the default installation.
Register a new user (let's call this user "user1").
Create a new organization with "private" visibility. We will refer to this organization as "user1org".
Make the user "user1" inside the organization visible.
Log out and register a new user ("user2").
Create an access token for "user2" with full access to the API.
Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token <user2-token>'

You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

AnalysisAI

Gitea's REST API leaks organization membership for private organizations through the GET /orgs/{org}/public_members/{username} endpoint, allowing any authenticated API user to enumerate whether a specific user belongs to a private organization. Affected versions are all releases prior to 1.27.0. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain authenticated API token

Delivery

Identify private organization name

Exploit

Target username to verify

Execution

Send GET /api/v1/orgs/{org}/public_members/{username}

Persist

Receive HTTP 204 confirming membership

Impact

Infer private org affiliation

Access

Obtain authenticated API token

Delivery

Identify private organization name

Exploit

Target username to verify

Execution

Send GET /api/v1/orgs/{org}/public_members/{username}

Persist

Receive HTTP 204 confirming membership

Impact

Infer private org affiliation

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) a valid API authentication token for any registered user on the Gitea instance (PR:L), (2) the target organization must be configured with 'private' visibility, (3) the target member must have their membership set to 'visible' (public) within the private organization - members with non-visible membership are not disclosed by this endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The real-world risk is moderate and primarily relevant to Gitea deployments where organizational privacy is a security or confidentiality requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers an account on a Gitea instance (or already has one) and obtains a personal API token. Knowing or guessing the name of a private organization and a target username, the attacker issues a GET request to /api/v1/orgs/{org}/public_members/{username} with their API token. …
Remediation	Vendor-released patch: Gitea v1.27.0, available at https://github.com/go-gitea/gitea/releases/tag/v1.27.0. … Detailed patch versions, workarounds, and compensating controls in full report.