Orta CVSS 4.3
CVE-2026-66853: CVE-2026-66853: hassas bilgi ifşası
Açıklama (NVD)
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
Özet bilgiler
- CVSS v3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- %0,37 (yüzdelik 31)
- CWE
- CWE-200
- Yama
- Yok / bilinmiyor