CVE-2026-58434
Received Received - Intake

Private Repository Metadata Exposure After Access Revocation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Private Repository Metadata Remains Accessible After Access Revocation

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58434
EUVD
EUVD-2026-58161

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea 1.27.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58434 is a vulnerability in Gitea where private repository metadata remains visible to users even after their access is revoked. The issue affects endpoints like starred and subscribed repositories, showing names, descriptions, and visibility status despite access removal.

Detection Guidance

To detect this vulnerability, check Gitea logs for repeated access attempts to the affected endpoints GET /api/v1/user/starred and GET /api/v1/user/subscriptions by users who no longer have repository access. Verify if removed collaborators can still view repository metadata through these endpoints.

Impact Analysis

Users removed from private repositories may still see metadata like names and descriptions of those repositories in their starred or subscribed lists. This could lead to unintended information exposure but does not grant access to contents, source code, or secrets.

Compliance Impact

This vulnerability may violate data protection principles by exposing repository metadata to unauthorized users. Compliance risks include potential breaches of GDPR's data minimization or HIPAA's access controls, depending on repository content.

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to patch the vulnerability. Review and remove any unauthorized access to starred or subscribed repositories. Monitor logs for suspicious activity related to these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart