Missing Authorization in Gitea - CVE-2026-58434
Published: July 14, 2026
Vulnerability identifier: #VU137425
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58434
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive repository metadata.
The vulnerability exists due to missing authorization in the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints when handling requests for private repository lists after access revocation. A remote user can request the affected endpoint to disclose sensitive repository metadata.
Exploitation requires prior legitimate access to the private repository and occurs after that access has been revoked.
Affected software
Gitea
How to mitigate CVE-2026-58434
Install security update from vendor's website.
Gitea - update to 1.27.0