The REST API endpoint that returns organization member lists was incorrectly implemented, allowing any user with API access to retrieve membership details for private organizations. Based on the description, it is inferred that the endpoint may be accessed without authentication. This grants an attacker knowledge of who belongs to a private organization, which could aid social engineering or credential harvesting. The weakness corresponds to CWE-284, a vulnerability where insufficient authorization controls permit unintended access.

The vulnerability is present in the Gitea Open Source Git Server. The product is listed without a specific affected version, but the vendor has released a patch in version 1.27.0, as referenced in the advisories. All installations running a Gitea version prior to that release are potentially affected unless the API has been manually disabled.

Based on the description, it is inferred that attackers can reach the endpoint over the network, requiring only internet connectivity and knowledge of the API endpoint. No exploit code is provided in the advisory. Although the EPSS score is not available and the vulnerability is not listed in KEV, the design flaw and public disclosure suggest a moderate to high likelihood of exploitation. The CVSS score is unspecified, but the impact on confidentiality and potential to facilitate further attacks warrants prompt attention.