CVE-2026-58415

MediumCVSS 5.3/10Last modified Oct 5, 2026

Description

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-584167.1Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-584177.5REST API exposes organization membership of private organizations to public CVE-2026-584186.5SSRF via HTTP Redirect in Repository Migration CVE-2026-584197.5Notification API leaks private issue metadata after access revocation CVE-2026-58427.3A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of CVE-2026-584204.4Local File Inclusion via file:// URI in Migration Restore CVE-2026-584217.5Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service CVE-2026-584229.8Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVE-2026-584237.7LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories CVE-2026-584248.9Permanent Fork PR Workflow Approval Gate Bypass CVE-2026-584254.3OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)CVE-2026-584269.6Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write