CVE-2026-58429

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A route-specific authorization failure allows a personal access token restricted to the public-only scope to retrieve private organization membership and permission details. While direct access to private organizations is blocked, the restriction is inconsistently enforced across other endpoints. This occurs because certain routes fail to apply the checkTokenPublicOnly() function or evaluate the user context instead of the organization object, allowing private data to be returned when the token belongs to the same user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.