Gitea organization permission APIs expose hidden membership and private organization data
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-25712US | — | — | ||
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/57b5ed3f252753797e790c060c42fbbe8219b9c1WEB
- https://github.com/go-gitea/gitea/commit/96515c0f200d37228dc84a599c6177297a230c94WEB
- https://github.com/go-gitea/gitea/pull/36798WEB
- https://github.com/go-gitea/gitea/pull/36841WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-25712ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan