← All advisories

High severity7.5NVD Advisory· Published Aug 13, 2026· Updated Aug 26, 2026

CVE-2026-58438

CVE-2026-58438

Description

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
gitea.devGo	< 1.27.0	1.27.0

Affected products

2

Go Gitea/Giteallm-fuzzy
Range: <1.27.0
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260727T201416-160000.1.1

Patches

Vulnerability mechanics

References

4

News mentions

1

Go Gitea: 25 Vulnerabilities Including SSRF and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 13, 2026