CVE-2026-58418

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

SSRF via HTTP Redirect in Repository Migration

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-584197.5Notification API leaks private issue metadata after access revocationCVE-2026-58427.3A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of CVE-2026-584204.4Local File Inclusion via file:// URI in Migration RestoreCVE-2026-584217.5Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceCVE-2026-584229.8Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsCVE-2026-584237.7LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesCVE-2026-584248.9Permanent Fork PR Workflow Approval Gate BypassCVE-2026-584254.3OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)CVE-2026-584269.6Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeCVE-2026-584277.5Private org member list leaked via /members API endpoint — incomplete fix for PR #38145CVE-2026-584286.5Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)CVE-2026-584294.9Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
CVE-2026-58418: Medium severity, CVSS 6.5 | Vulnix