CVE-2026-58432

MediumCVSS 5.9/10Last modified Aug 26, 2026

Description

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-639CWE-732CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-584339.1Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingCVE-2026-584347.5Private Repository Metadata Remains Accessible After Access RevocationCVE-2026-584355.4Gitea LFS Deploy-Key Privilege EscalationCVE-2026-584367.5ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsCVE-2026-584377.1Repository Visibility Manipulation via Git Push OptionsCVE-2026-584387.5Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessCVE-2026-584398.1Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagCVE-2026-58447.2A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkCVE-2026-584406.8Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (CVE-2026-584416.3SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLCVE-2026-584426.5Repository migration SSRF via multi-answer DNS allow-list bypassCVE-2026-584439.1Public-only repository tokens can update private PR head branches
CVE-2026-58432: Medium severity, CVSS 5.9 | Vulnix