CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58427

Gitea is vulnerable to an information disclosure flaw where private organization member lists are leaked via the /members API endpoint. This issue stems from an incomplete fix in PR #38145 , where the ListMembers() function in routers/api/v1/org/member.go fails to include a visibility check. Cons...

CVE-2026-58427: Exposure of Sensitive Information to an Unauthorized Actor

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...