GHSA-JR5X-6H83-WRXF

Vulnerability from github – Published: 2026-07-21 20:40 – Updated: 2026-07-21 20:40
VLAI
Summary
Gitea: REST API exposes organization membership of private organizations to public
Details

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

  1. Spin up the nightly container of Gitea.
  2. Perform the default installation.
  3. Register a new user (let's call this user "user1").
  4. Create a new organization with "private" visibility. We will refer to this organization as "user1org".
  5. Make the user "user1" inside the organization visible.
  6. Log out and register a new user ("user2").
  7. Create an access token for "user2" with full access to the API.
  8. Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token '

  1. You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gitea.dev"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:40:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe endpoint  \"/orgs/{org}/public_members/{username}\" + GET exposes organization membership of public members in a private organization.\n\n### PoC\n\n1. Spin up the nightly container of Gitea.\n2. Perform the default installation.\n3. Register a new user (let\u0027s call this user \"user1\").\n4. Create a new organization with \"private\" visibility. We will refer to this organization as \"user1org\".\n5. Make the user \"user1\" inside the organization visible.\n6. Log out and register a new user (\"user2\").\n7. Create an access token for \"user2\" with full access to the API.\n8. Use the endpoint \"/orgs/{org}/public_members/{username}\" + GET with the correct username of \"user1\", organization name, and access token of \"user2\" to query whether \"user1\" is a member of the organization. The following curl command demonstrates the usage:\n\ncurl -X \u0027GET\u0027 \\\n  \u0027http://localhost:4700/api/v1/orgs/user1org/public_members/user1\u0027 \\\n  -H \u0027accept: application/json\u0027 \\\n  -H \u0027authorization: token \u003cuser2-token\u003e\u0027\n\n9. You will receive status code 204, which leaks the organization membership.\n\n### Impact\n\nThe vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user\u0027s profile page is also hidden).",
  "id": "GHSA-jr5x-6h83-wrxf",
  "modified": "2026-07-21T20:40:55Z",
  "published": "2026-07-21T20:40:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/685b62c60fc595e3612a85f0895471876db56292"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gitea: REST API exposes organization membership of private organizations to public"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.