The vulnerability allows an unauthenticated user to retrieve detailed information about an organization’s teams. The exposed data includes team identifiers, names, descriptions, and permission levels, which could assist an attacker in mapping the internal structure of the repository service and planning targeted attacks. The weakness is a type of information disclosure (CWE‑200).

Any Gogs deployment running a version earlier than 0.14.3 is affected. The flaw occurs when the GET /api/v1/orgs/:orgname/teams endpoint is accessed without requiring credentials, exposing sensitive organizational data.

The CVSS score of 5.5 indicates a moderate risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, so there is no evidence of current exploitation at this time. The lack of authentication checks in the route definition means the attack vector is local network or internet access to the Gogs API, and the condition is that the attacker can send an HTTP request to the target without credentials.