CVE-2026-58443

A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request PR branches. This could lead to unauthorized changes in private code, compromising the integrity of the affected repositories. Mitigation Update to Gitea...

CVE-2026-58438

A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference IDOR, exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58507

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

EUVD-2026-58171

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58434

The Gitea application is vulnerable to an information disclosure flaw where private repository metadata remains accessible even after access revocation. While the specific root cause is not detailed in the provided documents, this issue allows for the exposure of sensitive information to unauthor...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

EUVD-2026-58151

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

PT-2026-71104

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...