The vulnerability allows an adversary to retrieve a list of members belonging to private organizations by accessing a REST API endpoint that was intended to be restricted. The exposed endpoint returns membership details without enforcing proper authorization checks, giving attackers a visibility advantage that can be leveraged for social engineering or targeted credential gathering. The flaw aligns with insufficient access control (CWE‑284) and missing access‑control enforcement (CWE‑863).

Any installation of the Gitea Open Source Git Server that exposes the affected REST API endpoint is susceptible. The specific product is Gitea, and no particular version or patch information is supplied. Systems exposing private organization membership listings through the public API are impacted; other Gitea deployments that have disabled or omitted these endpoints are not affected.

The vulnerability carries a CVSS score of 7.5, indicating a high severity level with a considerable impact on confidentiality. It is likely exploitable through an unauthenticated or minimally authenticated request to the open API endpoint, requiring only internet connectivity and knowledge of the endpoint URL; the EPSS score of <1% reflects a low current exploitation probability. Because it is not listed in the CISA KEV catalog, it has not yet been confirmed as a widely exploited vulnerability, but the potential for data disclosure and social engineering warrants timely monitoring and remediation.