CVE-2026-66853

Published: Oct 14, 2026Modified: Oct 14, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://blog.gitea.com/release-of-1.27.3/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/39047

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/39058

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.27.3

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-w4wc-g858-3672

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Timeline

No history available yet.