Pcat2003

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** A route-specific authorization failure allows a personal access token restricted to the public-only scope to retrieve private organization membership and permission details. While direct access to private organizations is blocked, the restriction is inconsistently enforced across other endpoints. This occurs because certain routes fail to apply the `checkTokenPublicOnly()` function or evaluate the user context instead of the organization object, allowing private data to be returned when the token belongs to the same user. **API Endpoints:** - '/api/v1/user/orgs' - '/api/v1/users/{username}/orgs/{org}/permissions' **Vulnerable Parameters or Variables:** - `username` - `org` **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.