The Gitea organization‑list API does not enforce the read:organization token scope, allowing an API token with an unrelated scope such as read:misc to retrieve organization metadata that the token’s owner can see. This is an authorization failure (CWE‑285). The exposed data may include limited and private organizations for a site administrator token, thereby bypassing intended access restrictions. The flaw can be abused to disclose organizational information that should be protected.

All Gitea installations that expose the organization‑list endpoint are affected, provided the deployed version lacks the fix that enforces token scope checks. The CVE information does not specify a version range, so any deployment that has not yet applied the vendor’s patch remains vulnerable.

The CVSS score of 4.3 and an EPSS below 1 % indicate moderate severity but a low, non‑zero likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. An attacker must possess any valid API token with a scope that is not read:organization to exploit the flaw; no additional privileges are required. The primary impact is information disclosure rather than code execution or denial of service.