The vulnerability arises from insufficient visibility checks in Gitea’s organization permission APIs, allowing an authenticated user to extract details about hidden members and private organizations. This creates an access control weakness (CWE-284) that could expose sensitive internal membership data and the private status of organizations to anyone who can authenticate to the API.

All deployments of Gitea Open Source Git Server running a version prior to 1.25.5 are affected. Any installation that has not upgraded past the 1.25.5 release is vulnerable to this privacy exposure.

The flaw carries a CVSS score of 7.5, reflecting medium to high severity. With an EPSS score of less than 1 %, the probability of exploitation at present is low, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated or internal attacker, as the API requires valid credentials to query organization membership and visibility data. An attacker with legitimate credentials could exploit the weakness to learn hidden membership details and the private status of organizations, potentially facilitating further malicious actions within the environment.