01 Record

CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

HighPUBLISHEDCNA: Gitea

Base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

02 Description

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Published: 2026-08-13 16:44Z1 DAY AGO
Last updated: 2026-08-14 17:30Z1 HR AGO
Reserved: 2026-06-30
Assigning CNA: Gitea
Record state: PUBLISHED
Severity: High (CVSS 7.5)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-200 CWE-863
SSVC decision: ExploitationnoneAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: f5618772943c4f8b8a3d1f2db6142c52fc718ab963c5c9f8540b50ab77170c87

VendorProductVersionsPlatforms