CVE-2026-58437

9th percentile - higher than 9% of all known CVEs

The vulnerability allows manipulation of repository visibility via Git push options. An attacker can change repository visibility (e.g., from private to public) without proper permissions.

This can lead to unauthorized disclosure of private repositories, constituting a serious confidentiality breach and potentially exposing the organization to data leakage.

Update Gitea to a patched version and restrict the use of push options to trusted users. Monitor repository visibility changes.