CVE-2026-58434

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A user who previously had access to a private repository can continue to obtain repository metadata after their access has been revoked. While direct access to the repository is correctly denied, the repository may still appear in the user's starred or subscription lists, allowing the retrieval of metadata such as the repository name (full name), description, and visibility status (private). This information remains current, as changes made to the metadata after access revocation are reflected in subsequent responses. This issue affects the following authenticated endpoints:

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.