Skip to content
Heist/ feed
Back to feed
Medium

Gitea restricted-user organization metadata disclosure

Type: advisorySources: OSV

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-66853
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 22:25 UTC · Revision 1

Source evidence

Gitea restricted-user organization metadata disclosure

core-osv · Original source

Published 14 Oct 2026, 14:36 UTC

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

osv:CVE-2026-66853
Complete source record
{
  "id": "76b64e594ac5fdd1389dd932014673f9384b4622caefd2dd1b1d5dc7e49346c1",
  "url": "https://osv.dev/vulnerability/CVE-2026-66853",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea restricted-user organization metadata disclosure",
    "summary": "Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.",
    "evidence": "osv:CVE-2026-66853",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-66853",
      "aliases": [
        "CVE-2026-66853",
        "GHSA-w4wc-g858-3672"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "146cc3eec57174711eac0e0a0c7b38670c6e3922"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.27.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "146cc3eec57174711eac0e0a0c7b38670c6e3922"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.27.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.27.2",
            "v1.27.1",
            "v1.27.0",
            "v1.27.0-rc0",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66853.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.114645498Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-1.27.3/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66853.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.27.3",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-w4wc-g858-3672",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-66853",
        "https://github.com/go-gitea/gitea/pull/39047",
        "https://github.com/go-gitea/gitea/pull/39058"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-200",
          "CWE-863"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66853.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-66853",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507598,
  "published_at": "2026-10-14T14:36:01.009+00:00"
}