Gitea's org-level Actions REST endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs are protected only by organization membership and token presence, but do not enforce per-repository access controls. The underlying database queries join on repository ownership by the organization but omit any filtering based on team membership, repository collaboration, or explicit permissions. Consequently, any org member can retrieve workflow run and job data from all repositories within the organization, including private repositories and those where the user has no access. The per-repository API endpoints correctly restrict access, returning 404 for unauthorized users, confirming the leak is unique to the org-level API surface. This vulnerability is classified under CWE-200 (Information Exposure) and CWE-863 (Incorrect Authorization).

Any user who is a member of an organization in Gitea can access sensitive workflow run and job information from all repositories in that organization, including private repositories and those where the user has no granted permissions. This leads to unauthorized information disclosure of potentially sensitive CI/CD workflow metadata and job details. There is no indication of code execution or integrity impact, but confidentiality is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict organization membership to trusted users only to limit exposure. Monitor for vendor updates addressing this authorization flaw in org-level Actions API endpoints.