CVE-2026-66853 in Gitea
Résumé
par MITRE • 14/10/2026
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.