CVE-2026-58434

21th percentile - higher than 21% of all known CVEs

Private repository metadata remains accessible after access revocation. This means that information about the repository (e.g., name, description) may still be visible to users who lost permissions.

This can lead to unauthorized disclosure of information about private projects, constituting a confidentiality breach and potentially aiding attackers in further attacks.

Update Gitea to a patched version and conduct an audit to ensure that access revocation also removes metadata access. Monitor metadata access.