Improper access control in Gitea - CVE-2026-58437
Published: July 14, 2026
Vulnerability identifier: #VU137445
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58437
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify repository visibility or template status without triggering normal repository change controls.
The vulnerability exists due to improper access control in HookPostReceive() in routers/private/hook_post_receive.go when processing git push options on existing repositories. A remote user can send a git push with the undocumented repo.private or repo.template option to modify repository visibility or template status without triggering normal repository change controls.
The issue bypasses audit and activity logging, webhook delivery, owner notifications, team permission recalculation, and updated_at timestamp changes.
Affected software
Gitea
How to mitigate CVE-2026-58437
Install security update from vendor's website.
Gitea - update to 1.27.0