CVE-2026-25712CWE-284

Gitea organization permission APIs expose private visibility information

High · published July 3, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea organization permission APIs expose private visibility information
    cvelistv5