CVE-2026-58429 in Gitea affects API endpoints GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions, where personal access tokens scoped as public-only can still access private organization membership and permission details for the token owner's account. The vulnerability arises because the middleware enforcing the public-only token restriction depends on route context that is not consistently populated, allowing private organization data to be disclosed through alternate code paths. Direct access to private organizations is correctly blocked, but indirect endpoints rely on user visibility logic that does not filter private organizations for public-only tokens, resulting in unauthorized data exposure.

An attacker or user with a personal access token restricted to public-only scope can retrieve private organization membership and permission details for their own account, violating the intended access control guarantees. This exposure includes private organization membership information and role details such as ownership, admin status, and repository creation capabilities. The vulnerability does not allow modification or denial of service but leaks sensitive private organization data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using personal access tokens with the public-only scope for accounts belonging to private organizations if private data exposure is a concern. Monitor vendor communications for updates and apply patches promptly once available.