CVE-2026-58429

CVE-2026-58429 affects Gitea’s Organization and Permission endpoints. Public-only tokens can bypass scope restrictions via /api/v1/user/orgs and related paths, enabling enumeration of private organizations and access permissions data for owned/admin roles. Root cause: inconsistent enforcement of ...

CVE-2026-58429

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:05+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j...