Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the Gitea REST API, specifically in two functions within routers/api/v1/org/member.go: ListPublicMembers and IsPublicMember. These functions correspond to the API endpoints /orgs/{org}/public_members and /orgs/{org}/public_members/{username} respectively. Before the patch, neither function performed an authorization check to ensure the user making the request had permission to view the organization. This oversight allowed an unprivileged user to query these endpoints for a private organization and, by receiving a 204 No Content status, confirm the existence of a public member within that private organization. This constitutes an information disclosure vulnerability (CWE-200). The fix, as seen in commit 685b62c60fc595e3612a85f0895471876db56292, was to add a visibility check at the beginning of both functions using organization.HasOrgOrUserVisible. This ensures that if the requesting user cannot see the organization, the API returns a 404 Not Found error, effectively patching the information leak.
ListPublicMembersrouters/api/v1/org/member.go
IsPublicMemberrouters/api/v1/org/member.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitea.dev | go | < 1.27.0 | 1.27.0 |