Repository Visibility Manipulation in Git

Executive Summary

CVE-2026-58437 is a high-severity flaw in Gitea affecting versions up to 1.26.4. It allows users with owner or admin-collaborator access to manipulate repository visibility (private/public) or template status using undocumented Git push options like repo.private and repo.template. These changes bypass audit trails, webhooks, and notifications, leaving no record in logs or alerts.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for unexpected changes in repository visibility or template status. Look for Git push options like repo.private or repo.template in push events. Review database entries for repositories with altered visibility but no corresponding audit trail or timestamp updates.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to exfiltrate private data, alter repository templates to poison supply chains, or hide unauthorized changes. The lack of audit trails makes it difficult to detect or trace malicious activity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines compliance by allowing unauthorized changes to repository visibility without detection. It could lead to data breaches (GDPR/HIPAA violations) due to lack of audit trails and improper access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to a version beyond 1.26.4. Remove undocumented Git push options (repo.private, repo.template) from the post-receive hook. Ensure visibility changes are routed through proper services to restore audit functionality and logging.

Useful 0 Not Useful 0