CVE-2026-58417
Fix: go-gitea/gitea#38145CVE-2026-58417 is a CWE-284 vulnerability in gitea.dev. O3 Security confirms whether CVE-2026-58417 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Gitea: REST API exposes organization membership of private organizations to public
Real-World Exposure
gitea.devReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization.
PoC
- Spin up the nightly container of Gitea.
- Perform the default installation.
- Register a new user (let's call this user "user1").
- Create a new organization with "private" visibility. We will refer to this organization as "user1org".
- Make the user "user1" inside the organization visible.
- Log out and register a new user ("user2").
- Create an access token for "user2" with full access to the API.
- Use the endpoint "/orgs/{org}/public_members/{username}" + GET with the correct username of "user1", organization name, and access token of "user2" to query whether "user1" is a member of the organization. The following curl command demonstrates the usage:
curl -X 'GET'
'http://localhost:4700/api/v1/orgs/user1org/public_members/user1'
-H 'accept: application/json'
-H 'authorization: token <user2-token>'
- You will receive status code 204, which leaks the organization membership.
Impact
The vulnerability discloses organization membership. An information that is not accessible via the web app (the organization is hidden, and therefore, the organization membership on the user's profile page is also hidden).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | gitea.dev | all versions | 1.27.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gitea.dev. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update gitea.dev to 1.27.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-58417 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-58417 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-58417. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-58417 in your dependencies?
O3 detects CVE-2026-58417 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.