CVE-2026-58432 Gitea: draft release attachment disclosure via missing web authorization
Attackers can bypass authorization checks to access sensitive information due to missing authorization and incorrect permission assignments in Gitea.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58432?
CVE-2026-58432 is a medium-severity missing authorization vulnerability in Gitea Open Source Git Server, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Which versions are affected by CVE-2026-58432?
3 open source packages ship an affected version, including code.gitea.io/gitea and gitea.dev.
| Package | Affected | Fixed in |
|---|---|---|
code.gitea.io/gitea Go | All versions | 1.27.0 |
code.gitea.io/gitea Go | All versions | 1.27.0 |
gitea.dev Go | All versions | 1.27.0 |
How do I fix CVE-2026-58432?
Upgrade code.gitea.io/gitea to 1.27.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-58432 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58432 exists.
Sources
Also known as GHSA-q9pg-jj6x-j9p6, GO-2026-6070, MINI-gcvc-q875-34xf, MINI-w987-w53m-m5m5.