EUVD-2026-352794

fkie_cve-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

GHSA-prr9-9mp4-5gp2 — Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Affected: Go: gitea.dev

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.

## Affected Versions <= v1.26.4 (latest) and main branch

## Root Cause routers/api/v1/org/member.go — ListMembers():

// Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

## Proof of Concept

# Setup: privateorg (private), alice = member, bob = outsider

# Bob lists ALL members of private org curl -s "http://gitea/api/v1/orgs/privateorg/members" \ -H "Authorization: token BOB_TOKEN"

# Result: HTTP 200 [{"login":"alice","email":"alice@test.com",...}] # Expected: HTTP 404

## Note This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched.

## Fix Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.

Most recent entries from all

EUVD-2026-352794

fkie_cve-2026-58427

GHSA-prr9-9mp4-5gp2 — Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen