Gitea
CVE-2026-58427
MEDIUM
GHSA-prr9-9mp4-5gp2
Severity by source
Network-reachable API, low complexity; PR:L because any authenticated account suffices; confidentiality impact is low (member list only, no code or credentials).
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
Summary
PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.
Affected Versions
<= v1.26.4 (latest) and main branch
Root Cause
routers/api/v1/org/member.go - ListMembers():
// Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }
Proof of Concept
Setup: privateorg (private), alice = member, bob = outsider
Bob lists ALL members of private org
curl -s "http://gitea/api/v1/orgs/privateorg/members" \ -H "Authorization: token BOB_TOKEN"
Result: HTTP 200
[{"login":"alice","email":"alice@test.com",...}]
Expected: HTTP 404
Note
This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched.
Fix
Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }
AnalysisAI
Private organization member enumeration in Gitea allows any authenticated user to retrieve the full member list - including emails - of a private organization via the /api/v1/orgs/{org}/members endpoint. All Gitea instances running v1.26.4 or earlier are affected; the flaw stems from an incomplete fix (PR #38145) that corrected ListPublicMembers and IsPublicMember but left ListMembers without the HasOrgOrUserVisible visibility gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Gitea bearer token for any user account on the target instance - no organization membership, no elevated role, and no special configuration is needed beyond basic authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An outsider Bob who holds any valid API token on the Gitea instance issues a single authenticated GET request to /api/v1/orgs/privateorg/members. The endpoint returns HTTP 200 with a JSON array containing the login and email address of every organization member - including alice and other private members - despite Bob having no organization membership. … |
| Remediation | Upgrade to Gitea v1.27.0, which introduces the missing HasOrgOrUserVisible() check in the ListMembers() handler, consistent with the fix already applied to ListPublicMembers and IsPublicMember. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today