4 matches found
CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427
Gitea is vulnerable to an information disclosure flaw where private organization member lists are leaked via the /members API endpoint. This issue stems from an incomplete fix in PR #38145 , where the ListMembers() function in routers/api/v1/org/member.go fails to include a visibility check. Cons...