What is the CVSS score of CVE-2026-58427?

CVE-2026-58427 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-58427?

A missing authorization check in Gitea allows any authenticated user to enumerate the complete roster and email addresses of private organizations.. A patch is available.

How to fix or mitigate CVE-2026-58427?

Within 24 hours, identify which Gitea instances in production host private organizations and confirm current version numbers against the vendor advisory. Within 7 days, apply the available security patch released by Gitea to all affected instances and verify the fix through API endpoint testing. Within 30 days, audit access logs for the vulnerable endpoint (/api/v1/orgs/{org}/members) across the preceding 30 days to identify any potential unauthorized member enumeration attempts.

Gitea CVE-2026-58427

EUVD-2026-58155 HIGH

Information Exposure (CWE-200)

2026-07-21 https://github.com/go-gitea/gitea

GHSA-prr9-9mp4-5gp2

Information Disclosure Gitea

7.5

CVSS 3.1 · Vendor: https://github.com/go-gitea/gitea

Severity by source

Vendor (https://github.com/go-gitea/gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Authentication is explicitly required per the description and PoC, so PR:L not PR:N; only confidentiality is impacted via member list disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/go-gitea/gitea).

CVSS VectorVendor: https://github.com/go-gitea/gitea

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 14, 2026 - 18:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 14, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Aug 14, 2026 - 18:22 NVD

7.5 (HIGH)

Source Code Evidence Fetched

Jul 22, 2026 - 02:45 vuln.today

Analysis Generated

Jul 22, 2026 - 02:45 vuln.today

DescriptionCVE.org

Summary

PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.

Affected Versions

<= v1.26.4 (latest) and main branch

Root Cause

routers/api/v1/org/member.go - ListMembers():

// Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

Proof of Concept

Setup: privateorg (private), alice = member, bob = outsider

Bob lists ALL members of private org

curl -s "http://gitea/api/v1/orgs/privateorg/members" \ -H "Authorization: token BOB_TOKEN"

Result: HTTP 200

[{"login":"alice","email":"alice@test.com",...}]

Expected: HTTP 404

Note

This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched.

Fix

Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

AnalysisAI

Private organization member enumeration in Gitea allows any authenticated user to retrieve the full member roster - including emails - of a private organization via the /api/v1/orgs/{org}/members endpoint. The root cause is an incomplete fix: PR #38145 added visibility guards to ListPublicMembers and IsPublicMember but omitted the same guard from ListMembers, leaving a single missing HasOrgOrUserVisible check in routers/api/v1/org/member.go. Proof-of-concept code is publicly available in the GitHub Security Advisory; no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (5th percentile) indicates low probability of widespread automated exploitation.

Technical ContextAI

Gitea is a self-hosted, open-source Git service written in Go (pkg:go/gitea.dev). The affected code path is the ListMembers() handler in routers/api/v1/org/member.go, which services GET /api/v1/orgs/{org}/members. The root cause is CWE-200 (Exposure of Sensitive Information to Unauthorized Actor): the handler processes the request without first calling organization.HasOrgOrUserVisible() to verify that the requesting user has permission to see the organization's full membership. A parallel fix for the public_members endpoints was applied in PR #38145, confirming the intended access-control pattern exists and is functional - it was simply never ported to the ListMembers route. The leaked response body includes member logins and email addresses per the PoC output.

RemediationAI

Upgrade to Gitea v1.27.0 or later, which applies the missing HasOrgOrUserVisible() guard to ListMembers() in routers/api/v1/org/member.go. The patch is confirmed in the GitHub Security Advisory GHSA-prr9-9mp4-5gp2 (https://github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2) and the official release blog at https://blog.gitea.com/gitea-1.27.0-is-released/. If an immediate upgrade is not possible, a compensating control is to restrict API access to the /api/v1/orgs/*/members endpoint via a reverse proxy (e.g., block or require additional authentication on that path pattern in nginx/Caddy); note this may break legitimate tooling that calls the members API. Auditing Gitea access logs for unexpected calls to /api/v1/orgs/{org}/members from accounts not belonging to those organizations can help detect exploitation attempts retroactively.