Is CVE-2026-58427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58427 being exploited in the wild.

How severe is CVE-2026-58427?

Medium severity, with a CVSS score of 5.3, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; gitea.dev (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-58427?

Yes. gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58427 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58427?

Check whether you run Gitea or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58427: Gitea information disclosure in private organization member list

Q: Which products and versions are affected?

Gitea < 1.27.0; gitea.dev (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-58427?

Yes. gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58427 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-58427?

Check whether you run Gitea or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58427 · Severity: medium · CVSS 5.3 · Published 2026-07-21

Gitea is an open-source platform for hosting software development projects. A security flaw allows any logged-in user to view the full list of members within a private organization, even if they are not part of that organization. This could lead to the exposure of internal team structures and employee email addresses, potentially aiding in targeted phishing or social engineering attacks.

Technologies: Gitea, gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58427 being exploited in the wild.
How severe is CVE-2026-58427?: Medium severity, with a CVSS score of 5.3, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; gitea.dev (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-58427?: Yes. gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58427 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58427?: Check whether you run Gitea or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

An authorization bypass exists in Gitea's API due to an incomplete fix for a previous vulnerability. While public member listing endpoints were secured, the 'ListMembers' function in 'routers/api/v1/org/member.go' lacks a visibility check. An authenticated attacker can send a GET request to '/api/v1/orgs/{org}/members' to retrieve a full list of members, including their login names and email addresses, for organizations they do not have permission to view. This vulnerability is addressed in version 1.27.0 by adding the missing 'HasOrgOrUserVisible' check.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-58427
GHSA-prr9-9mp4-5gp2
GO-2026-6068

Timeline

2026-07-13: disclosed: Initial report published to go-gitea/gitea
2026-07-21: advisory: GitHub Advisory GHSA-prr9-9mp4-5gp2 published
2026-07-21: patched: Fixed in version 1.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.