{"id":"EUVD-2026-41622","enisaUuid":"f1e4a601-b86c-3caa-b8e1-e597e0564cd3","description":"Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.","datePublished":"Jul 3, 2026, 8:19:32 PM","dateUpdated":"Jul 7, 2026, 4:59:58 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/pull/36798\nhttps://github.com/go-gitea/gitea/pull/36841\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-25712\nGHSA-37w2-86g3-h4qh\n","assigner":"Gitea","epss":0.48,"enisaIdProduct":[{"id":"ad5c77c1-7b5f-3372-81e0-4351dccf657c","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"81c8e139-78b9-3889-bb3c-1a799d887c62","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"12fe30d4-dafc-3b21-8835-cfa8dfbaad87","vulnerability":{"id":"CVE-2026-25712","description":"Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.","datePublished":"Jul 3, 2026, 8:19:32 PM","dateUpdated":"Jul 7, 2026, 4:59:58 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/pull/36798\nhttps://github.com/go-gitea/gitea/pull/36841\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41622\n","assigner":"Gitea","epss":0.48,"dataProcessed":"Nov 7, 2026, 7:16:38 AM","vulnerabilityProduct":[{"id":"0515e5c1-a43d-384e-b33b-d586ede352bb","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"76e7da04-87a2-3eb7-97e9-bfe0e619d716","vendor":{"name":"Gitea"}}]}},{"id":"8e542809-fbaa-3b16-920e-905041d462b9","vulnerability":{"id":"GHSA-37w2-86g3-h4qh","description":"Gitea organization permission APIs expose hidden membership and private organization data","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:22:06 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-25712\nhttps://github.com/go-gitea/gitea/pull/36798\nhttps://github.com/go-gitea/gitea/pull/36841\nhttps://github.com/go-gitea/gitea/commit/57b5ed3f252753797e790c060c42fbbe8219b9c1\nhttps://github.com/go-gitea/gitea/commit/96515c0f200d37228dc84a599c6177297a230c94\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41622\n","aliases":"CVE-2026-25712\nGHSA-37w2-86g3-h4qh\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}