CVE-2026-58417
Gitea: REST API exposes organization membership of private organizations to public
描述
### Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization. ### PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user (let's call this user "user1"). 4. Create a new organization with "private" visibility. We will refer to this organization as "user1org". 5. Make the user "user1" inside the organization visible. 6. Log out and register a new user ("user2"). 7. Create an access token for "user2" with full access to the API. 8. Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage: curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token <user2-token>' 9. You will receive status code 204, which leaks the organization membership. ### Impact The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).
如何修補 CVE-2026-58417
要修補 CVE-2026-58417,請將受影響套件升級到下列已修補版本。
- —升級至 1.27.0 或更新版本
CVE-2026-58417 正在被利用嗎?
目前沒有被利用訊號。CVE-2026-58417 既不在 CISA KEV 也沒有最新的 EPSS 分數。
受影響套件(1)
- from 0, < 1.27.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |