CVE-2026-58438

19th percentile - higher than 19% of all known CVEs

A cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access. There is a lack of proper object-level authorization.

Attackers can interfere with private repositories, modify dependencies, and add comments, potentially leading to confidentiality and integrity breaches and disruption of team work.

Update Gitea to a patched version and audit access permissions for issue dependencies. Consider implementing security tests for IDOR.