A critical access control vulnerability in the Gitea Open Source Git Server allows unauthenticated actors to enumerate private organization members, posing a significant risk to organizational privacy.

The application fails to properly enforce access restrictions within its REST API, which exposes sensitive organization membership data to unauthenticated entities. This flaw stems from improper access control (CWE-284) that allows unauthorized information disclosure.

The exposure of private organization membership information can lead to severe reputational damage, the compromise of sensitive internal project structures, and the potential targeting of specific employees by malicious actors. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that could facilitate reconnaissance for more complex social engineering or targeted attacks against your development infrastructure.

Immediate Action: Update the Gitea Open Source Git Server to version 1.27.0 or later immediately to resolve the improper access control flaw.

Proactive Monitoring: Review web server and application access logs for unusual patterns of API requests targeting organization membership endpoints by unauthenticated IP addresses.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall (WAF) to restrict access to the Gitea REST API, specifically blocking unauthorized requests to sensitive organization-related paths.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS severity and the confirmed existence of a proof-of-concept, organizations should treat this vulnerability with urgency. Upgrading to version 1.27.0 is the only definitive way to close the access control gap and protect sensitive organizational metadata from unauthorized exposure.