CVE-2026-66853

Deferred Deferred - Pending Action

Gitea Organization List API Visibility Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-66853

EUVD

EUVD-2026-101087

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-66853 is a vulnerability in Gitea where restricted users can list limited-visibility organizations for other users via the organization-list API. The API incorrectly includes organizations marked as limited in responses, exposing metadata like names, descriptions, and avatars that should be hidden.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version prior to 1.27.3. Use the command: curl -s http://your-gitea-server/api/v1/version | grep "version". If the version is below 1.27.3, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthorized users with restricted access to view sensitive organization details they shouldn't have permission to see. It exposes metadata that could be used to infer organizational structures or relationships, potentially aiding further attacks.

Compliance Impact

This vulnerability exposes sensitive organization metadata (names, descriptions, avatars) to unauthorized restricted users, violating confidentiality policies. While not directly tied to GDPR or HIPAA, such unauthorized data exposure could contribute to compliance violations by failing to protect personal or sensitive information as required by these regulations.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. This can be done by downloading the latest release from the official Gitea repository or using your package manager to update the software.

Hi! I’m here to help you understand CVE-2026-66853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70