CVE-2026-58507

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea contains an information disclosure issue where requests containing the go-get query parameter with a value of 1 bypass authentication and authorization checks. This behavior is triggered in the httpBase() and EarlyResponseForGoGetMeta() functions. When this parameter is detected in a repository path, the system returns an HTTP 200 response containing metadata tags, regardless of whether the repository is private or the user is authenticated.

This allows unauthenticated attackers to confirm the existence of private repositories, enumerate private repository names through brute-force, and harvest sensitive information such as full clone URLs, owner usernames, and default branch names. This occurs because the system was designed to provide a workaround for the Go toolchain's handling of credentials, resulting in an unauthenticated endpoint for every repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

As a temporary mitigation, restrict access to the go-get query parameter for private repositories or implement a check to ensure that EarlyResponseForGoGetMeta() is only called for public repositories or authenticated users with read permissions.