CVE-2026-66853 Gitea restricted-user organization metadata disclosure
Restricted users can view limited-visibility organization metadata via the list API, exposing hidden names and descriptions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66853?
CVE-2026-66853 is a medium-severity vulnerability in Gitea, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
Which versions are affected by CVE-2026-66853?
How do I fix CVE-2026-66853?
No fix has been published for CVE-2026-66853 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66853 being exploited?
There is no known exploitation of CVE-2026-66853 in the wild and no public exploit code.
Sources
Also known as GHSA-w4wc-g858-3672.