CVE-2026-58416

A flaw was found in Gitea. The Fork-PR Actions task, which handles pull requests from forked repositories, can be exploited to read data from a third private repository. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacke...

CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...