Private Repository Existence Disclosure via Go-Get Meta Endpoint

Executive Summary

CVE-2026-58507 is a vulnerability in Gitea, a self-hosted Git service, that allows unauthenticated attackers to confirm the existence of private repositories and gather sensitive metadata. The issue arises from Gitea's handling of the go-get query parameter, which bypasses authentication checks and returns repository details like names, clone URLs, and branch names even for private repositories.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Gitea server logs for requests containing the '?go-get=1' query parameter. Use commands like 'grep "go-get=1" /var/log/gitea/*.log' to search for such requests. Additionally, monitor HTTP responses for 200 status codes with meta tags containing repository details in responses to unauthenticated requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to confirm private repository existence, enumerate repository names, and harvest sensitive metadata like clone URLs and default branches. This information could be used for further attacks such as credential-stuffing or targeted exploits against exposed repositories.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Gitea to a version that includes the fix for this vulnerability. If upgrading is not immediately possible, disable the '?go-get=1' endpoint or restrict access to authenticated users only. Review server logs for signs of exploitation and ensure no sensitive repository information has been exposed.

Useful 0 Not Useful 0