CVE-2026-58427
published 2026-08-13CVE-2026-58427: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.34%
26.7th percentile
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
ghsa·2026-07-21
CVE-2026-58427 [MEDIUM] CWE-200 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
## Summary
PR #38145 fixed ListPublicMembers and IsPublicMember but missed
ListMembers. Any authenticated user can enumerate ALL members
(not just public ones) of a private organization.
## Affected Versions
<= v1.26.4 (latest) and main branch
## Root Cause
routers/api/v1/org/member.go — ListMembers():
// Missing check:
if !organization.HasOrgOrUserVisible(ctx,
ctx.Org.Organization.AsUser(), ctx.Doer) {
ctx.APIErrorNotFound()
return
}
## Proof of Concept
# Setup: privateorg (private), alice = member, bob = outsider
# Bob lists ALL members of private org
curl -s "http://gitea/api/v1/orgs/privateorg/members" \
-H "Authorization: token BOB_TOKEN"
# Result: HTTP 200
[{"login":"alice","email":
Red Hat
gitea.dev: Gitea: Information disclosure of private organization member lists
vendor_redhat·2026-08-13·CVSS 7.5
CVE-2026-58427 [HIGH] CWE-359 gitea.dev: Gitea: Information disclosure of private organization member lists
gitea.dev: Gitea: Information disclosure of private organization member lists
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
A flaw was found in Gitea. An incomplete fix for a previous vulnerability allowed any authenticated user to enumerate all members of a private organization through the `/members` API endpoint. This information disclosure could expose sensitive details about an organization's internal structure and personnel to unauthorized individuals.
Package: openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 (OpenShift Pipelines) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [fedora-all]
bugzilla·2026-08-20·CVSS 7.5
CVE-2026-58427 [HIGH] CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [fedora-all]
CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Bugzilla
CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [epel-all]
bugzilla·2026-08-20·CVSS 7.5
CVE-2026-58427 [HIGH] CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [epel-all]
CVE-2026-58427 forgejo: Gitea: Information disclosure of private organization member lists [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Bugzilla
CVE-2026-58427 gitea.dev: Gitea: Information disclosure of private organization member lists
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-58427 [HIGH] CVE-2026-58427 gitea.dev: Gitea: Information disclosure of private organization member lists
CVE-2026-58427 gitea.dev: Gitea: Information disclosure of private organization member lists
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
2026-08-13
Published