CVE-2026-25714 affects Gitea Open Source Git Server versions up to 1.26.1. The issue arises because the user organization API does not consistently apply public-only token filtering, leaving an incomplete fix for the earlier CVE-2025-68941. This inconsistency leads to an authorization bypass vulnerability classified as CWE-862, where users may gain access to organization information without proper authorization. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level with network attack vector, low attack complexity, and requiring low privileges without user interaction.

The vulnerability allows unauthorized access to organization-related data through the user organization API due to improper enforcement of access controls. The impact is limited to confidentiality loss (partial information disclosure) without integrity or availability impact. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published as of the provided data. Users should monitor Gitea vendor advisories for updates and apply any forthcoming patches promptly. Until a fix is available, consider restricting access to the user organization API or applying additional access controls where possible.