CVE-2026-58507

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58507

Gitea exposes a security vulnerability where a repository’s existence and metadata can be disclosed via a go-get=1 meta response, bypassing authentication. The CVE-2026-58507 family shows that when a request to a repository’s path includes go-get=1, the server returns HTTP 200 with tags for go-i...

CVE-2026-58507

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:30+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-p4mj-98mv-xq26...