CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427

The Gitea source code repository contains a vulnerability where the ListMembers function in the /members API endpoint fails to perform an authorization check. Specifically, the code in routers/api/v1/org/member.go lacks a required check to verify if the requesting user has permission to view memb...

CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...