Quick answers
- Is CVE-2026-58417 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58417 being exploited in the wild.
- How severe is CVE-2026-58417?
- Medium severity, with a CVSS score of 4, published 21 July 2026.
- Which products and versions are affected?
- Gitea < 1.27.0; gitea.dev (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0.
- Is there a fix for CVE-2026-58417?
- Yes. gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58417 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-58417?
- Check whether you run Gitea or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- gitea.dev (Go): upgrade to 1.27.0 or later
go get gitea.dev@v1.27.0
Technical details
An information disclosure vulnerability exists in Gitea's REST API due to improper authorization checks in the '/orgs/{org}/public_members/{username}' GET endpoint. While the web interface correctly hides private organizations and their memberships, the API endpoint returns a 204 No Content status code if a user is a member, even if the organization is private. An attacker with a valid user account and access token can programmatically query memberships of private organizations. This bypasses intended visibility restrictions (CWE-200, CWE-863). The issue is resolved in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Identifiers
- CVE-2026-58417
- GHSA-jr5x-6h83-wrxf
- GO-2026-6063
Timeline
- 2026-07-13: disclosed: Initial disclosure to vendor
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0