Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-58431: Gitea: Public Tokens Can Access Private Team Data
CVE-2026-58431 · published 2 months ago
Summary
A public token in Gitea can still access private team data, including repositories and activity feeds. This happens when the token is supposed to be limited to public data only. To fix this, update to the latest version of Gitea, and ensure that public tokens are not used for private data access.
What to do
- Update gitea.dev to version 1.27.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | – | gitea.dev |
< 1.27.0 Fix: upgrade to 1.27.0
|
| – | gitea | gitea open source git server | <= 1.26.4 |
Original advisory text
Public-only API token restriction is not enforced on team API routes
Public-only API token restriction is not enforced on team API routes
References
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0 Vendor Advisory
- https://github.com/advisories/GHSA-h56g-4qw7-2mxg
- https://blog.gitea.com/gitea-1.27.0-is-released/ Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58431... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58431 Vendor Advisory
- https://github.com/go-gitea/gitea/security/advisories/GHSA-h56g-4qw7-2mxg Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published13 Aug 2026
Updated4 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta