CVE-2026-58427

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization. ## Affected Versions <= v1.26.4 (latest) and main branch ## Root Cause routers/api/v1/org/member.go — ListMembers(): // Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return } ## Proof of Concept # Setup: privateorg (private), alice = member, bob = outsider # Bob lists ALL members of private org curl -s "http://gitea/api/v1/orgs/privateorg/members" \ -H "Authorization: token BOB_TOKEN" # Result: HTTP 200 [{"login":"alice","email":"alice@test.com",...}] # Expected: HTTP 404 ## Note This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched. ## Fix Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 in gitea.dev