CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427

CVE-2026-58427 concerns Gitea: Private org member list leakage via the /orgs/{org}/members endpoint due to an incomplete fix for PR #38145. Concrete details across connected docs show the root cause as a missing access-control check in ListMembers(), allowing an authenticated user to enumerate al...