CVE-2026-58427

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.5

Description An authenticated user can enumerate all members of a private organization, including those who are not public. This occurs because the ListMembers() function fails to verify if the organization or user is visible to the requester. The issue affects the '/orgs/{org}/members' API endpoint.

Recommendations Update to a version where the ListMembers() function includes a visibility check to ensure only authorized users can list members of a private organization. As a temporary workaround, restrict access to the '/orgs/{org}/members' API endpoint to minimize the risk of member enumeration.