CVE-2026-58416

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2

Description A confidentiality breach exists where an attacker-controlled fork pull-request workflow can gain read access to a third private repository. This occurs because the GetActionsUserRepoPermission() function in models/perm/access/repo permission.go fails to implement a fork pull-request guard in the collaborative-owner logic branch. While other access paths correctly deny access to fork pull-requests, this specific branch allows a task token to obtain maxPerm (code-read) if the target repository B trusts the owner of the base repository A as a collaborative owner, provided that repository A is private.

Technical details include:

Recommendations Update Gitea to a version where the GetActionsUserRepoPermission() function is patched to include the !task.IsForkPullRequest guard within the collaborative-owner check to ensure fork pull-requests are denied cross-repo access.