CVE-2026-25712
published 2026-07-03CVE-2026-25712: Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.48%
40.1th percentile
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.25.5 | 1.25.5 |
| gitea | gitea_open_source_git_server | < 1.25.5 | 1.25.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
ghsa_unreviewed·2026-07-03
CVE-2026-25712 CWE-284 Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
GHSA
Gitea organization permission APIs expose hidden membership and private organization data
ghsa·2026-07-03
CVE-2026-25712 [HIGH] CWE-284 Gitea organization permission APIs expose hidden membership and private organization data
Gitea organization permission APIs expose hidden membership and private organization data
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published