CVE-2026-58507

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58507

CVE-2026-58507 affects Gitea: Private Repository Existence Disclosure via the go-get meta endpoint. The vulnerability arises when a request includes ?go-get=1, triggering EarlyResponseForGoGetMeta before authentication/authorization, and returning HTTP 200 with go-import/go-source metadata. This ...

CVE-2026-58507

creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:30+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-p4mj-98mv-xq26...