CVE-2026-58427

HighCVSS 7.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

The vulnerability leaks the member list of private organizations via the /members API endpoint. This is an incomplete fix for PR #38145.

Risk of exposing sensitive information about organization members, potentially violating privacy and enabling social engineering attacks.

Install the latest patch that fully addresses the issue and check other API endpoints for similar data exposure.

Original NVD description (English source)

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145