CVE-2026-66853: Gitea restricted-user organization metadata disclosure
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Gitea account that is restricted can exploit it. The account must be able to query the organization-list API for a known user's public organization memberships.
What information can be disclosed?
The affected API can reveal limited-visibility organizations associated with the queried user, including their names, descriptions, and avatars. The disclosure is organization metadata that should be hidden from the restricted requesting account.
Does exploitation require access to a limited organization?
No. The issue is specifically that a restricted account can receive limited-visibility organization metadata through the organization-list API despite the visibility restriction applied by the single-organization endpoint.