CVE-2026-66853

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The user organization-list API endpoint fails to apply visibility restrictions for authenticated restricted accounts. This allows a restricted user to list the public organization memberships of a known user and retrieve metadata—including names, descriptions, and avatars—of organizations with limited visibility that should be hidden from the requesting account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.