Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Summary PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization. Affected Versions = v1.26.4 latest and main branch Root Cause routers/api/v1/org/member.go — ListMembers: // Missing...

GHSA-PRR9-9MP4-5GP2 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Summary PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization. Affected Versions = v1.26.4 latest and main branch Root Cause routers/api/v1/org/member.go — ListMembers: // Missing...

GHSA-V73X-HX65-6PF4 Gitea: Unauthorized Access to Labels of Private Organizations

Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to...

EUVD-2026-41621

Gitea: Unauthorized Access to Labels of Private Organizations...

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

CVE-2026-47697 Shelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

CVE-2026-47697

Shelf is a multi-tenant platform for tracking physical assets. Prior to version 1.20.2, several endpoints accepted entity IDs from input and connected/read/updated them without verifying ownership, enabling cross-tenant IDOR where an authenticated user in Org A could access Org B’s data (assets, ...

CVE-2026-47697 Shelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

GHSA-JR5X-6H83-WRXF Gitea: REST API exposes organization membership of private organizations to public

Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...

Gitea: REST API exposes organization membership of private organizations to public

Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...

GHSA-RJVX-X5H2-6PX5 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...

PT-2026-63292

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The REST API exposes organization membership of public members within a private organization. An unauthorized user can determine if a specific user is a member of a private organization by...

PT-2026-63298

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The /api/v1/teams/id API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these...

PT-2026-63297

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A route-specific authorization failure allows a personal access token restricted to the public-only scope to retrieve private organization membership and permission details. While direct access...

Gitea: REST API exposes organization membership of private organizations to public

The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization...

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization...

PT-2026-63295

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.5 Description An authenticated user can enumerate all members of a private organization, including those who are not public. This occurs because the ListMembers function fails to verify if the organization or user ...

EUVD-2026-44740

@better-auth/sso: SSO provider may allow registration for any org member without a checking their role...

@better-auth/sso: SSO provider may allow registration for any org member without a checking their role

Am I affected? You are affected if all of the following are true: - You depend on @better-auth/sso at any version in = 1.2.10, 1.6.11, or any current next pre-release. - You enable both sso and organization plugins. - providersLimit is at its default 10 or any non-zero value, so SSO provider...

Malicious Package

Overview @gocortexio/npmgremlinbox-arphic-1999 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...