CVE-2026-58424

HighCVSS 8.9/10Last modified Oct 25, 2026

Description

Permanent Fork PR Workflow Approval Gate Bypass

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

Weakness enumeration

CWE-285CWE-732CWE-863

Affected software

VendorProductVersions
GiteaGitea Open Source Git Server<= 1.26.2

References

Timeline

Published
Jul 3, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-584254.3OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)CVE-2026-584269.6Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeCVE-2026-584277.5Private org member list leaked via /members API endpoint — incomplete fix for PR #38145CVE-2026-584286.5Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)CVE-2026-584294.9Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsCVE-2026-58438.6The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary PythCVE-2026-584314.3Public-only API token restriction is not enforced on team API routesCVE-2026-584325.9Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and ExpCVE-2026-584339.1Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingCVE-2026-584347.5Private Repository Metadata Remains Accessible After Access RevocationCVE-2026-584355.4Gitea LFS Deploy-Key Privilege EscalationCVE-2026-584367.5ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests