CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58444: Incorrect Authorization

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

PT-2026-71104

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...

SUSE CVE-2026-52799

Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository. In a test environment with REQUIRESIGNINVIEW = false, we...

SUSE CVE-2026-52812

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone /// but per-repo authorization lives in the lfsobject table keyed repoid, oid. serveUpload skips re-uploading when the OID file already exists on disk and inserts a new repoid, oid r...

GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev

Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...

GO-2026-6066 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev...

PT-2026-65364

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev...

PT-2026-65360

Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...

GO-2026-6052 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) in gitea.dev

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard in gitea.dev...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...