VDB
CVE-2026-66853
CVE-2026-66853
PUBLISHED
CVSS 4.3 MEDIUM
Reported by Gitea · Published October 14, 2026
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-w4wc-g858-3672 vendor-advisory
- Gitea 1.27.3 release announcement release-notes
- Fix: go-gitea/gitea pull request #39047 patch
- Fix: go-gitea/gitea pull request #39058 patch
- go-gitea/gitea v1.27.3 release release-notes