CVE-2026-58417
published 2026-08-13CVE-2026-58417: REST API exposes organization membership of private organizations to public
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.34%
26.7th percentile
REST API exposes organization membership of private organizations to public
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: REST API exposes organization membership of private organizations to public
ghsa·2026-07-21
CVE-2026-58417 [MEDIUM] CWE-200 Gitea: REST API exposes organization membership of private organizations to public
Gitea: REST API exposes organization membership of private organizations to public
### Summary
The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.
### PoC
1. Spin up the nightly container of Gitea.
2. Perform the default installation.
3. Register a new user (let's call this user "user1").
4. Create a new organization with "private" visibility. We will refer to this organization as "user1org".
5. Make the user "user1" inside the organization visible.
6. Log out and register a new user ("user2").
7. Create an access token for "user2" with full access to the API.
8. Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "u
Red Hat
gitea.dev: Gitea: Information disclosure via REST API exposes private organization membership
vendor_redhat·2026-08-13·CVSS 7.5
CVE-2026-58417 [HIGH] CWE-863 gitea.dev: Gitea: Information disclosure via REST API exposes private organization membership
gitea.dev: Gitea: Information disclosure via REST API exposes private organization membership
A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure.
Statement: This flaw has a Moderate impact. A vulnerability in Gitea's REST API allows an authenticated user to discover the membership of public members in private organizations via the /orgs/{org}/public_members/{username} endpoint. The information disclosed is limited to organization membership status. Red Hat products that bundle code.gitea.io/gitea as a Go dependency do not run the Gitea web server and may
No detection rules found.
No public exploits indexed.
2026-08-13
Published