CVE-2026-58431

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2

Description The /api/v1/teams/{id} API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these routes may return private team repository metadata and private team activity feed entries. This occurs because the checkTokenPublicOnly middleware fails to verify organization visibility when ctx.Org.Organization is nil. Additionally, team repository handlers do not apply repository-level filtering via ctx.TokenCanAccessRepo(repo), and the team activity feed handler fails to apply opts.ApplyPublicOnly(ctx.PublicOnly) while having IncludePrivate set to true.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.