The vulnerability resides in the organization‑list API of Gitea and allows an authenticated restricted user to retrieve organization metadata—names, descriptions, and avatars—that should otherwise be hidden. This information exposure can aid an attacker in reconnaissance by revealing details about an individual’s limited-visibility organization memberships.

The affected product is Gitea by Gitea. No specific version range is listed in the CVE entry, but the fix is included in release 1.27.3, implying that earlier releases are likely vulnerable.

Based on the description, the vulnerability requires an authenticated restricted user to access the organization‑list API. The likely attack vector is therefore a legitimate request made by such a restricted account. The attacker can enumerate the organization memberships of any other user and retrieve names, descriptions, and avatars of limited‑visibility organizations that should be hidden, providing reconnaissance information. The CVSS base score is 4.3, indicating low severity, and the EPSS score is less than 1 %, implying a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. With these metrics, the overall risk remains low, though the disclosure of organization metadata may still facilitate future attacks.