Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Description

Affected Products

Vendor	Product	Versions
gitea	gitea	0

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-xv9x-fj9g-vj6h(vendor-advisory)
https://github.com/go-gitea/gitea/releases/tag/v1.27.0(release-notes)
https://blog.gitea.com/gitea-1.27.0-is-released/(release-notes)

Related News (1 articles)

Tier C

VulDB12d ago

CVE-2026-58438 | Gitea up to 1.26.4 authorization

→ No new info (linked only)

CVSS 3.17.5 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

gitea.dev@1.27.0

CWECWE-862

PublishedJul 21, 2026

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-20896EXPKEV

Gitea Docker image trusts spoofable reverse-proxy headers by default

Trending: 144

CRITICALCVE-2026-58433

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Trending: 13

HIGHCVE-2026-58417

REST API exposes organization membership of private organizations to public

Trending: 11

CRITICALCVE-2026-58508

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Trending: 11

HIGHCVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Trending: 8

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 21, 2026

Discovered by ZDM

Jul 21, 2026

Patch Available

Aug 14, 2026