CVE-2026-57886

MediumCVSS 5.9/10Last modified Aug 26, 2026

Description

Cross-repository issue/comment attachment re-linking can expose private attachment content

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639CWE-862

Affected software

VendorProductVersions
GiteaGitea Open Source Git Server<= 1.26.4

References

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-57897.8Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code witCVE-2026-578908.7Improper cleanup on thrown exception in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: HypervCVE-2026-578918.7Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may alloCVE-2026-578928.8Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) withCVE-2026-578936.8Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: HyperCVE-2026-578948.5Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationCVE-2026-578958.5Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installatCVE-2026-578966.1An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafCVE-2026-578976.5Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsCVE-2026-578989.0In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to CVE-2026-57905.1Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and CVE-2026-579078.5A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection
CVE-2026-57886: Medium severity, CVSS 5.9 | Vulnix