GHSA-37w2-86g3-h4qh
Gitea organization permission APIs expose hidden membership and private organization data
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.25.5 | 1.25.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-25712
- https://github.com/go-gitea/gitea/pull/36798
- https://github.com/go-gitea/gitea/pull/36841
- https://github.com/go-gitea/gitea/commit/57b5ed3f252753797e790c060c42fbbe8219b9c1
- https://github.com/go-gitea/gitea/commit/96515c0f200d37228dc84a599c6177297a230c94
- https://blog.gitea.com/release-of-1.25.5
- https://github.com/go-gitea/gitea
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5