CVE-2026-58417

MEDIUMPre-NVD 0.0
0.0
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No confirmed exploitation signals yet
CISA-KEV: Not listedEPSS: —CVSS: —Exploit: NoneExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Gitea: REST API exposes organization membership of private organizations to public

Summary

The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.

PoC

  • Spin up the nightly container of Gitea.
  • Perform the default installation.
  • Register a new user (let's call this user "user1").
  • Create a new organization with "private" visibility. We will refer to this organization as "user1org".
  • Make the user "user1" inside the organization visible.
  • Log out and register a new user ("user2").
  • Create an access token for "user2" with full access to the API.
  • Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:

curl -X 'GET' \ 'http://localhost:4700/api/v1/orgs/user1org/public_members/user1' \ -H 'accept: application/json' \ -H 'authorization: token '

  • You will receive status code 204, which leaks the organization membership.

Impact

The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).

CVSS v3
—
EG Score
0.0(none)
EG Risk
0
EG Risk 0/100

EG Risk is EchelonGraph's 0–100 priority score. It fuses intrinsic severity with real-world exploitation and automatability, so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. It is distinct from the 0–10 EG Score, which measures severity.

EPSS
—
KEV
Not listed

Published

July 21, 2026

Last Modified

July 21, 2026

Vendor Advisories for CVE-2026-58417(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Go(1)
PackageVulnerable rangeFixed inDependents
gitea.dev—1.27.0—

Data Freshness Timeline

(refreshed 2× in last 7d / 2× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-23 03:21 UTCEG score recompute
  2. 2026-07-21 21:21 UTCEG score recompute

Frequently asked(3)

What is CVE-2026-58417?
CVE-2026-58417 is a medium vulnerability published on July 21, 2026. Gitea: REST API exposes organization membership of private organizations to public Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default…
When was CVE-2026-58417 disclosed?
CVE-2026-58417 was first published in the National Vulnerability Database on July 21, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
How do I remediate CVE-2026-58417?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-58417, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-58417

Explore →

Is Your Infrastructure Affected by CVE-2026-58417?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs