38 matches found
SUSE CVE-2026-25712
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...
EUVD-2026-58152
REST API exposes organization membership of private organizations to public...
CVE-2026-58417 REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public...
CVE-2026-58417 REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public...
CVE-2026-58417
The Gitea REST API contains an information disclosure vulnerability where it exposes organization membership of private organizations to the public. Specifically, the GET endpoint /orgs/{org}/public_members/{username} reveals whether a specific user belongs to a private organization, even though ...
GO-2026-6076 Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea
Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea...
GO-2026-6063 Gitea: REST API exposes organization membership of private organizations to public in gitea.dev
Gitea: REST API exposes organization membership of private organizations to public in gitea.dev...
PT-2026-65373
Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...
EUVD-2026-41621
Gitea: Unauthorized Access to Labels of Private Organizations...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the organization permission APIs due to insufficient visibility checks for hidden members and private organizations. An attacker can access private visibility information by querying these APIs. Remediation...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the organization permission APIs due to insufficient visibility checks for hidden members and private organizations. An attacker can access private visibility information by querying these APIs. Remediation...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the label process. An attacker can obtain sensitive information by accessing labels associated with private organizations without proper authorization. Remediation Upgrade gitea.dev/services/auth to version...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the label process. An attacker can obtain sensitive information by accessing labels associated with private organizations without proper authorization. Remediation Upgrade github.com/go-gitea/gitea/models/auth ...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the label process. An attacker can obtain sensitive information by accessing labels associated with private organizations without proper authorization. Remediation Upgrade...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the label process. An attacker can obtain sensitive information by accessing labels associated with private organizations without proper authorization. Remediation Upgrade gitea.dev/models/auth to version 1.26....
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the label process. An attacker can obtain sensitive information by accessing labels associated with private organizations without proper authorization. Remediation Upgrade github.com/go-gitea/gitea/services/aut...
Gitea organization permission APIs expose hidden membership and private organization data
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...
GHSA-37W2-86G3-H4QH Gitea organization permission APIs expose hidden membership and private organization data
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...
