vulnerability / NVI-00016107 / Revision 1
Gitea: REST API exposes organization membership of private organizations to public
GitHub lists this reviewed advisory for gitea.dev. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
gitea.dev
source listed< 1.27.0
### Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization. ### PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user (let's call this user "user1"). 4. Create a new organization with "private" visibility. We will refer to this organization as "user1org". 5. Make the user "user1" inside the organization visible. 6. Log out and register a new user ("user2"). 7. Create an access token for "user2" with full access to the API. 8. Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage: curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token ' 9. You will receive status code 204, which leaks the organization membership. ### Impact The vulnerability discloses organization membership. An information that is not accessible via the web app (the o
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-jr5x-6h83-wrxf ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.