The vulnerability (CVE-2026-58417) exists in Gitea's REST API endpoint /orgs/{org}/public_members/{username}, which is intended to expose public members of an organization. However, in private organizations, this endpoint improperly reveals membership information by returning a 204 status code when queried with a valid username and organization name, even though the organization and its members are hidden in the web UI. This allows an authenticated user with an API token to confirm membership of users in private organizations. The issue affects Gitea versions prior to 1.27.0.

This vulnerability leads to unauthorized disclosure of organization membership information for private organizations. Although the organization and its members are hidden in the web interface, the API endpoint leaks membership data to any user with an API token, potentially exposing sensitive information about organizational structure and membership.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API token permissions and avoid exposing tokens to untrusted users. Monitor vendor channels for updates regarding a patch or official mitigation.