CVE-2026-58444

Mode C: CVE-2026-58444 in Gitea enables a token-scope bypass on the repository home page. Root cause: repo.Home does not enforce repository-scoped token checks, so a token without the repository scope (e.g., read:user/public-only) may render private repository data on GET /{owner}/{repo} (README,...

CVE-2026-58444

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:56+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-cp3q-vrj2-ghhh...