CVE-2026-58432: gitea gitea open source git server
CVSS: 5.9v3.1MediumDeferred
AliasesGHSA-q9pg-jj6x-j9p6GO-2026-6070
Published 13-08-2026Last modified 14-08-2026
Vulnerability summary
CVE-2026-58432 is a medium (CVSS 5.9) vulnerability in gitea gitea open source git server. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.43%
0%100%
Low · +0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 13-08-2026PublishedVulnerability first disclosed.
- 14-08-2026Last modifiedVulnerability information updated.
Description
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
CVSS metrics
3 scores · 3 sources · 1 versionMedium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.16 pp
From 0.27% on 19-09-2026
19-09-202619-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Code.gitea.io1 product
- gitea< 1.27.0
Gitea1 product
- gitea open source git server≤ 1.26.4
Go1 product
- gitea.dev< 1.27.0
3 vendors · 3 products
References
8 links- blog.gitea.com/gitea-1.27.0-is-released/Release Notes
- github.com/go-gitea/giteaPACKAGE