CVE-2026-58417: Gitea information disclosure in private organization membership API

Executive brief

Gitea is a self-hosted software development service similar to GitHub. A security flaw in its programming interface (API) allows registered users to discover if someone is a member of a private organization, even when that organization is set to be hidden. This could lead to the unauthorized disclosure of sensitive professional or project-related associations that were intended to remain confidential.

Technical details

An information disclosure vulnerability exists in Gitea's REST API due to improper authorization checks in the '/orgs/{org}/public_members/{username}' GET endpoint. While the web interface correctly hides private organizations and their memberships, the API endpoint returns a 204 No Content status code if a user is a member, even if the organization is private. An attacker with a valid user account and access token can programmatically query memberships of private organizations. This bypasses intended visibility restrictions (CWE-200, CWE-863). The issue is resolved in version 1.27.0.

Affected products

• Gitea Gitea < 1.27.0

Timeline

• 2026-07-13: disclosed: Initial disclosure to vendor
• 2026-07-21: advisory: GitHub Advisory published
• 2026-07-21: patched: Fix released in version 1.27.0

References

• https://api.github.com/users/maluff
• https://github.com/maluff
• https://api.github.com/users/maluff/gists%7B/gist_id%7D
• https://api.github.com/users/maluff/repos
• https://avatars.githubusercontent.com/u/32894288?v=4
• https://api.github.com/users/maluff/events%7B/privacy%7D