Incorrect authorization in Gitea - CVE-2026-58444
Published: July 14, 2026
Vulnerability identifier: #VU137417
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58444
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose private repository contents.
The vulnerability exists due to incorrect authorization in the repository home page route (`GET /{owner}/{repo}` / `repo.Home`) when handling HTTP Basic authentication with a personal access token or OAuth2 token lacking the `repository` scope or restricted to public repositories. A remote user can send a request to the repository home page to disclose private repository contents.
The disclosure is limited to the repository root view and includes the rendered README, root file and directory listing, description, language statistics, license, and latest-release information.
Affected software
Gitea
How to mitigate CVE-2026-58444
Install security update from vendor's website.
Gitea - update to 1.27.0