Razzlemouse

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.5 **Description** An authenticated user can enumerate all members of a private organization, including those who are not public. This occurs because the `ListMembers()` function fails to verify if the organization or user is visible to the requester. The issue affects the '/orgs/{org}/members' API endpoint. **Recommendations** Update to a version where the `ListMembers()` function includes a visibility check to ensure only authorized users can list members of a private organization. As a temporary workaround, restrict access to the '/orgs/{org}/members' API endpoint to minimize the risk of member enumeration.