CVE-2026-58444

MediumCVSS 4.3

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents.

A person with a limited-scope token can access private repositories, violating data confidentiality.

Update Gitea to a patched version and ensure access tokens are properly enforced on all API paths.

Original NVD description (English source)

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents