CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427

CVE-2026-58427 concerns Gitea: an incomplete fix left the private organization member list exposed via the /orgs/{org}/members endpoint. The root cause is a missing access-control check in ListMembers(), allowing any authenticated user to enumerate all members of a private org, not just public on...