CVE-2026-58427
Received Received - Intake

Private org member list disclosure via /members API endpoint

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58427
EUVD
EUVD-2026-58155

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
go-gitea gitea 1.27.0
go-gitea gitea to 1.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows authenticated users to view all members of a private organization in Gitea through the /orgs/{org}/members API endpoint. The issue occurs because a previous fix missed the ListMembers function, which still incorrectly exposes sensitive membership data due to flawed authorization checks.

Detection Guidance

Check Gitea version with 'gitea --version' or via admin panel. If version is 1.26.4 or earlier, the system is vulnerable. Monitor API logs for repeated requests to /orgs/{org}/members endpoint by authenticated users.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to access private organization member lists, potentially revealing sensitive information about team structures, roles, or collaborations. This could lead to privacy breaches or targeted attacks against exposed members.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing personal or sensitive information without proper authorization. Organizations using affected Gitea versions could face compliance violations, legal penalties, or reputational damage due to unauthorized data exposure.

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately. Review and restrict access to /orgs/{org}/members API endpoint. Audit logs for unauthorized access attempts to member lists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart