CVE-2026-70407

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-66853

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-70407 Gitea organization listing token scope bypass

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-70407

The Gitea organization-list API (endpoint GET /api/v1/orgs) fails to enforce the read:organization token scope. Consequently, a token with a different category, such as read:misc , can retrieve organization metadata visible to its owner. If the token belongs to a site administrator , the response...

CVE-2026-66853 Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

CVE-2026-66853

The Gitea user organization-list API fails to apply visibility restrictions for authenticated restricted accounts, allowing them to enumerate Limited-visibility organizations . A restricted user can list a known user's public organization memberships via the GET /api/v1/users/{username}/orgs endp...

CVE-2026-66853

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...

EUVD-2026-101087

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limit...