Gitea CVE-2026-58427

The attacker must possess a valid authentication token for any account on the Gitea instance - the API endpoint requires authentication, contradicting the published PR:N CVSS metric. The target organization must be configured as private (public organizations expose member lists by design, so there is no vulnerability in that context). No special roles, admin access, or organization membership is required beyond a basic authenticated account. Exploitation is limited to the /api/v1/orgs/{org}/members REST endpoint; the /members web UI route may have independent access controls. Instances where API access is network-restricted or where anonymous/public registration is disabled significantly reduce the attacker pool.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) carries a 7.5 score but contains a material error: PR:N implies unauthenticated exploitation, yet the CVE description, advisory, and PoC all explicitly require a valid authentication token ('Authorization: token BOB_TOKEN'). The correct privilege level is PR:L, which yields a recalculated score of approximately 6.5 (Medium). This discrepancy means defenders relying on the published CVSS score alone will overestimate the attack surface. The EPSS score (0.16%, 5th percentile) corroborates limited real-world exploitation activity. No CISA KEV listing exists. A working PoC is published in the GitHub advisory, lowering the barrier to exploitation but the requirement for a valid Gitea account meaningfully constrains the attacker pool to registered or compromised users on the target instance. The confidentiality impact is genuine - private org membership and email addresses are exposed - but integrity and availability are unaffected. Real-world priority is moderate: organizations operating private Gitea instances with sensitive membership data (e.g., internal security teams, corporate R&D orgs) should treat this as urgent; public Gitea instances with openly-visible organizations face negligible additional risk.

An attacker with any valid Gitea account on the target instance - including a low-privilege account created for a public repository - sends a single authenticated GET request to /api/v1/orgs/targetorg/members with their token. The server returns HTTP 200 with a JSON array of all private organization members including usernames and email addresses, bypassing the intended HTTP 404 response for non-members. A publicly available PoC curl command is included in the GitHub Security Advisory, requiring no additional tooling.