CVE-2026-66853: Gitea restricted-user organization metadata disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-14
Weakness: CWE-200

Description

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

Affected products

Gitea Open Source Git Server: through 1.27.2

References

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39047
https://github.com/go-gitea/gitea/pull/39058
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-w4wc-g858-3672

Get alerted when CVE-2026-66853 or the next vulnerability affects your stack