CVE-2026-58416
Received Received - Intake

Fork-PR Actions Task Exposes Private Repository via Collaborative-Owner Branch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58416
EUVD
EUVD-2026-58151

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea's Fork-PR Actions task allows an attacker to read a third private repository via the collaborative-owner branch due to a missing fork-PR guard. The issue occurs in the GetActionsUserRepoPermission function where the collaborative-owner branch does not enforce the !task.IsForkPullRequest check.

Impact Analysis

An attacker could exploit this to access and read the full source code of a private repository they should not have access to. This requires a private base repository, a private third repository with collaborative-owner trust, and a running fork-PR task token.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy) due to the confidentiality breach.

Mitigation Strategies

Apply the official patch from Gitea to add the missing fork-PR guard in the GetActionsUserRepoPermission function. Review repository trust settings to ensure no unauthorized collaborative-owner relationships exist between private repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart