CVE-2026-25712 describes an access control vulnerability in Gitea versions before 1.25.5. The issue arises from insufficient visibility checks in the organization permission APIs, specifically affecting hidden members and private organizations. This could allow unauthorized users to gain read access to information that should be restricted. The vulnerability is categorized under CWE-284, indicating improper access control. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild.

The vulnerability allows unauthorized users to access sensitive information related to hidden members and private organizations within Gitea instances. This compromises confidentiality but does not affect integrity or availability. The CVSS score of 7.5 reflects a high impact on confidentiality with network attack vector, low attack complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Gitea instance and carefully manage organization membership visibility settings to minimize exposure. Monitor official Gitea channels for updates regarding patches or temporary mitigations.