CVE-2026-58438

CVE-2026-58438 (Gitea) : Cross-repository IDOR in issue-dependency removal. The RemoveDependency path in routers/web/repo/issue_dependency.go fetches the dep issue by ID without repository or permission checks, enabling a user with write access to one repo (ownerA/repoA) to delete a dependency li...