Gitea's API endpoint /orgs/{org}/members exposes the full member list of private organizations to any authenticated user due to a missing access control check in the ListMembers function. While previous fixes addressed public member enumeration, this endpoint remains vulnerable, allowing unauthorized enumeration of private organization members. The root cause is the absence of a verification step to confirm if the requesting user has visibility rights to the organization members. The recommended fix is to add an access check similar to that used in other member listing functions.

Any authenticated user can retrieve the complete list of members of a private organization, potentially exposing sensitive membership information that should remain confidential. This information disclosure could aid attackers in reconnaissance but does not directly allow modification or deletion of data.

A fix is available in Gitea version 1.27.0 and later, which adds the missing access control check to the ListMembers function. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until patched, restrict API access to trusted users only if possible.