Information Disclosure in Gitea's User Organization-List API for Restricted Accounts
CVE-2026-66853

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-66853?

Gitea's user organization-list API has a flaw that allows authenticated restricted accounts to access limited-visibility organizations without adhering to the necessary visibility restrictions. This vulnerability enables a restricted user to enumerate a known user's public organization memberships, thus revealing sensitive organization metadata such as names, descriptions, and avatars that should remain hidden. This exposure creates risks for user privacy and data security within the platform.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39047
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Black1hp
https://github.com/Mon3mRT
https://github.com/bircni
.