Executive brief
Gitea is an open-source platform for hosting software development projects. A security flaw allows any logged-in user to view the full list of members within a private organization, even if they are not part of that organization. This could lead to the exposure of internal team structures and employee email addresses, potentially aiding in targeted phishing or social engineering attacks.
Technical details
An authorization bypass exists in Gitea's API due to an incomplete fix for a previous vulnerability. While public member listing endpoints were secured, the 'ListMembers' function in 'routers/api/v1/org/member.go' lacks a visibility check. An authenticated attacker can send a GET request to '/api/v1/orgs/{org}/members' to retrieve a full list of members, including their login names and email addresses, for organizations they do not have permission to view. This vulnerability is addressed in version 1.27.0 by adding the missing 'HasOrgOrUserVisible' check.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial report published to go-gitea/gitea
- 2026-07-21: advisory: GitHub Advisory GHSA-prr9-9mp4-5gp2 published
- 2026-07-21: patched: Fixed in version 1.27.0