CVE-2026-58427: Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

July 21, 2026

PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.

References

github.com/advisories/GHSA-prr9-9mp4-5gp2
github.com/go-gitea/gitea/releases/tag/v1.27.0
github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2
nvd.nist.gov/vuln/detail/CVE-2026-58427

Code Behaviors & Features

Detect and mitigate CVE-2026-58427 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →