PT-2026-63292 · Go · Gitea.Dev
CVE-2026-58417
·
Publicado
2026-07-21
·
Atualizado
2026-07-21
CVSS v4.0
5.3
Média
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Summary
The endpoint "/orgs/{org}/public members/{username}" + GET exposes organization membership of public members in a private organization.
PoC
- Spin up the nightly container of Gitea.
- Perform the default installation.
- Register a new user (let's call this user "user1").
- Create a new organization with "private" visibility. We will refer to this organization as "user1org".
- Make the user "user1" inside the organization visible.
- Log out and register a new user ("user2").
- Create an access token for "user2" with full access to the API.
- Use the endpoint "/orgs/{org}/public members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:
curl -X 'GET'
'http://localhost:4700/api/v1/orgs/user1org/public members/user1'
-H 'accept: application/json'
-H 'authorization: token '
- You will receive status code 204, which leaks the organization membership.
Impact
The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).
Correção
Information Disclosure
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gitea.Dev