Personal Access Token Scope Enforcement Bypass in Gitea
CVE-2026-58444

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58444?

A vulnerability in Gitea allows unauthorized access to private repository contents through a bypass of personal access token scope enforcement. This issue can occur when a user accesses the repository homepage using a GET request, which may disclose sensitive repository data to users who should not have access. To mitigate this risk, users are advised to update to the latest version of Gitea and review their access token configurations.

Affected Version(s)

Gitea Open Source Git Server 0 < 1.27.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

StarPlatinu
.