CVE-2026-58437

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the undocumented push options repo.private and repo.template during a git push to toggle a repository's visibility between private and public or change its template status. This process occurs within the HookPostReceive() function in the routers/private/hook post receive.go file.

This action bypasses standard security controls and administrative tracking, resulting in no entries in the repository audit or activity logs, no webhook events, no organization-level notifications, and no email alerts to watchers. Additionally, the use of the UpdateRepositoryColsNoAutoTime function suppresses the updated at timestamp, making the change difficult to detect. This could allow an insider threat to temporarily make a private repository public for data exfiltration or silently manipulate repository templates to affect downstream CI/CD pipelines.

Recommendations As a temporary mitigation, restrict admin-collaborator access to only trusted users to prevent unauthorized visibility changes. Remove the repo.private and repo.template options from the post-receive hook for existing repositories, ensuring they are only processed during the push-to-create flow. Alternatively, modify the code to route visibility changes through the full visibility-change service to ensure audit events, webhooks, and team re-syncs are properly triggered.