CVE-2026-25712

EUVD-2026-41622
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 28.37%
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36798
https://github.com/go-gitea/gitea/pull/36841
https://github.com/go-gitea/gitea/releases/tag/v1.25.5