Release Attachment Extension Allowlist Bypass in Gitea Software
CVE-2026-58428

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58428?

A vulnerability has been identified in Gitea that allows attackers to bypass the release attachment extension allowlist via the web release edit form. This issue may lead to unauthorized access to sensitive resources or data. Users are urged to ensure they are running the latest version of Gitea to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bl4cksku11
.