CVE-2026-58438

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.5

Description A broken access control issue exists in the RemoveDependency function within routers/web/repo/issue dependency.go. The function processes the removeDependencyID form parameter to identify and remove an issue dependency using issues model.GetIssueByID(ctx, depID) without performing necessary repository or permission checks. This allows an attacker with write access to issues in one repository to remove a dependency link to an issue in a different private repository and inject a comment into that private repository, even if they lack read access to it. This is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization.

Recommendations Update Gitea to version 1.26.5 or later. As a temporary mitigation, restrict the use of the removeDependencyID parameter in the /owner/repo/issues/N/dependency/delete endpoint to authorized users only.