Vulnerability-Lookup

CVE-2026-58417 (GCVE-0-2026-58417)

Vulnerability from cvelistv5 – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44

Title

REST API exposes organization membership of private organizations to public

Summary

REST API exposes organization membership of private organizations to public

Severity

No CVSS data available.

CWE

CWE-284

Assigner

Gitea

References

3 references

URL	Tags
https://github.com/go-gitea/gitea/security/adviso…	vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0	release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/	release-notes

Impacted products

1 product

Vendor	Product	Version
Gitea	Gitea Open Source Git Server	Affected: 0 , ≤ 1.26.4 (semver)

Credits

maluff Sai2r mgelde

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.26.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "maluff"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sai2r"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "mgelde"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REST API exposes organization membership of private organizations to public"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T16:44:47.004Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf"
        },
        {
          "name": "Gitea v1.27.0 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
        },
        {
          "name": "Gitea v1.27.0 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
        }
      ],
      "title": "REST API exposes organization membership of private organizations to public",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-58417",
    "datePublished": "2026-08-13T16:44:47.004Z",
    "dateReserved": "2026-06-30T18:57:20.613Z",
    "dateUpdated": "2026-08-13T16:44:47.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-58417\",\"sourceIdentifier\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\",\"published\":\"2026-08-13T17:17:26.410\",\"lastModified\":\"2026-08-13T17:17:26.410\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"REST API exposes organization membership of private organizations to public\"}],\"affected\":[{\"source\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\",\"affectedData\":[{\"vendor\":\"Gitea\",\"product\":\"Gitea Open Source Git Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"1.26.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://blog.gitea.com/gitea-1.27.0-is-released/\",\"source\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\"},{\"url\":\"https://github.com/go-gitea/gitea/releases/tag/v1.27.0\",\"source\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\"},{\"url\":\"https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf\",\"source\":\"88ee5874-cf24-4952-aea0-31affedb7ff2\"}]}}"
  }
}

GHSA-JR5X-6H83-WRXF

Vulnerability from github – Published: 2026-07-21 20:40 – Updated: 2026-07-21 20:40

Summary

Gitea: REST API exposes organization membership of private organizations to public

Details

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

Spin up the nightly container of Gitea.
Perform the default installation.
Register a new user (let's call this user "user1").
Create a new organization with "private" visibility. We will refer to this organization as "user1org".
Make the user "user1" inside the organization visible.
Log out and register a new user ("user2").
Create an access token for "user2" with full access to the API.
Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token '

You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gitea.dev"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:40:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe endpoint  \"/orgs/{org}/public_members/{username}\" + GET exposes organization membership of public members in a private organization.\n\n### PoC\n\n1. Spin up the nightly container of Gitea.\n2. Perform the default installation.\n3. Register a new user (let\u0027s call this user \"user1\").\n4. Create a new organization with \"private\" visibility. We will refer to this organization as \"user1org\".\n5. Make the user \"user1\" inside the organization visible.\n6. Log out and register a new user (\"user2\").\n7. Create an access token for \"user2\" with full access to the API.\n8. Use the endpoint \"/orgs/{org}/public_members/{username}\" + GET with the correct username of \"user1\", organization name, and access token of \"user2\" to query whether \"user1\" is a member of the organization. The following curl command demonstrates the usage:\n\ncurl -X \u0027GET\u0027 \\\n  \u0027http://localhost:4700/api/v1/orgs/user1org/public_members/user1\u0027 \\\n  -H \u0027accept: application/json\u0027 \\\n  -H \u0027authorization: token \u003cuser2-token\u003e\u0027\n\n9. You will receive status code 204, which leaks the organization membership.\n\n### Impact\n\nThe vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user\u0027s profile page is also hidden).",
  "id": "GHSA-jr5x-6h83-wrxf",
  "modified": "2026-07-21T20:40:55Z",
  "published": "2026-07-21T20:40:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/685b62c60fc595e3612a85f0895471876db56292"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gitea: REST API exposes organization membership of private organizations to public"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-58417 (GCVE-0-2026-58417)

GHSA-JR5X-6H83-WRXF

Summary

PoC

Impact

Tags

Sightings

Nomenclature