The vulnerability in Gitea allows an attacker to retrieve the list of members belonging to a private organization through the /members API endpoint. The endpoint returns member information that should be access‑controlled, leading to a confidentiality breach. The flaw is a result of an incomplete patch for pull request #38145 and can expose usernames, email addresses, and other identifying details of organization members. An attacker who can reach the API can gather sensitive personnel data without authentication or with minimal privileges.

This weakness affects all installations of Gitea Open Source Git Server that have not applied the patch included in the 1.27.0 release. Earlier releases, particularly those older than 1.27.0, are vulnerable, as the fix was not fully integrated until that version. The issue is specific to the /members endpoint and applies to environments where private organizations exist.

The risk level is elevated in environments where private organizations are used, as an attacker can gather membership information by exercising the /members API. Since the vulnerability can be exercised by simply making authenticated or unauthenticated requests to the endpoint, it is presumed to be exploitable remotely. The CVSS score is 7.5, and the EPSS score is < 1%. The vulnerability is not listed in KEV, but the information disclosure remains a serious concern.