CVE-2026-58429: Gitea public-only token scope bypass in Organization and Permission endpoints

CVE-2026-58429 · Severity: medium · CVSS 4.9 · Published 2026-07-21

Gitea is an open-source platform for hosting software development projects. A security flaw allows restricted access tokens, which are supposed to only see public information, to view private organization names and membership details. This could allow a third-party tool or a compromised automation script to see internal organizational structures that should have remained hidden.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58429 being exploited in the wild.
How severe is CVE-2026-58429?
Medium severity, with a CVSS score of 4.9, published 21 July 2026.
Which products and versions are affected?
Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-58429?
Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58429 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58429?
Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
    go get code.gitea.io/gitea@v1.27.0
  • gitea.dev (Go): upgrade to 1.27.0 or later
    go get gitea.dev@v1.27.0

Technical details

An authorization bypass exists in Gitea's API where 'public-only' scoped Personal Access Tokens (PATs) can access private organization data. While direct access to private organizations via '/api/v1/orgs/{org}' is correctly blocked, the restriction is not consistently enforced on other endpoints. Specifically, 'GET /api/v1/user/orgs' lacks the 'checkTokenPublicOnly' middleware entirely, and 'GET /api/v1/users/{username}/orgs' fails to filter results because the middleware evaluates the path user rather than the returned organization objects. Additionally, the permissions endpoint relies on general user visibility logic rather than token-specific restrictions. This allows an attacker with a restricted token to enumerate private organization names and retrieve role information like admin status and repository creation capabilities. The issue is fixed in version 1.27.0.

Affected products

  • Gitea Gitea < 1.27.0

Identifiers

  • CVE-2026-58429
  • GHSA-fq2p-5p22-8g6j
  • GO-2026-6053

Timeline

  • 2026-07-13: advisory: GitHub Advisory published
  • 2026-07-21: disclosed: External disclosure date
  • 1.27.0: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.