CVE-2026-58437

HighCVSS 7.1/10Last modified Aug 26, 2026

Description

Repository Visibility Manipulation via Git Push Options

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-584387.5Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessCVE-2026-584398.1Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagCVE-2026-58447.2A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sprintf of the file prog.cgi of the component HNAP1 SetNetworkCVE-2026-584406.8Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (CVE-2026-584416.3SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLCVE-2026-584426.5Repository migration SSRF via multi-answer DNS allow-list bypassCVE-2026-584439.1Public-only repository tokens can update private PR head branchesCVE-2026-584444.3Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsCVE-2026-584452.7Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APICVE-2026-584466.5Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/ACVE-2026-584476.5Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticateCVE-2026-584486.5yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arb
CVE-2026-58437: High severity, CVSS 7.1 | Vulnix