CVE-2026-58510
Received Received - Intake

ClearRepoWatches Stale Watches in API EditRepo Path

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58510
EUVD
EUVD-2026-58123

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea From 1.25.4 (inc) to HEAD (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-281 The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58510 is a vulnerability in Gitea where a fix for clearing repository watches during public-to-private transitions was not applied to the API path. The original fix addressed the issue in the MakeRepoPrivate function but missed the sister function updateRepository, which handles the same transition via the REST API. This allows stale watch records to persist, exposing repository metadata to unauthorized users.

Detection Guidance

Check Gitea logs for API calls to updateRepository that transition repositories from public to private. Monitor endpoints like /user/subscriptions for unexpected metadata exposure. Verify watch counts (NumWatches) for repositories that were made private via API.

Impact Analysis

This vulnerability can expose repository metadata to unauthorized users through endpoints like /user/subscriptions and inflate the NumWatches counter. It particularly affects organizations using API-driven automation to manage repositories, as they may inadvertently trigger the unpatched code path.

Mitigation Strategies

Apply the ClearRepoWatches fix to the updateRepository function in Gitea. Update to the latest patched version if available. Review and clear stale watch records manually if necessary. Audit API-driven automation for repository state changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart