Is CVE-2026-58444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58444 being exploited in the wild.

How severe is CVE-2026-58444?

Medium severity, with a CVSS score of 4.3, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-58444?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58444 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58444?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58444: Gitea token scope bypass in repository home page

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-58444?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58444 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58444?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58444 · Severity: medium · CVSS 4.3 · Published 2026-07-21

Gitea is an open-source platform for hosting software development projects. A security flaw allowed users with restricted access tokens (such as those intended only for public data or specific tasks like reading user profiles) to view the home page of private repositories they shouldn't be able to access. This could lead to the unauthorized disclosure of sensitive information, including project descriptions, file lists, and README files.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58444 being exploited in the wild.
How severe is CVE-2026-58444?: Medium severity, with a CVSS score of 4.3, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-58444?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58444 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58444?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

A token scope enforcement bypass exists in Gitea's `repo.Home` handler (`GET /{owner}/{repo}`). While other web routes like archive downloads and RSS feeds correctly validate personal access tokens (PAT) or OAuth2 tokens against the required 'repository' scope using `context.CheckRepoScopedToken`, the repository home route lacks this check. An attacker with a valid token (even one scoped as 'public-only' or 'read:user') can bypass intended restrictions to view a private repository's rendered README, file/directory tree, and other metadata. This vulnerability is limited to the root view as deeper sub-paths require different authentication checks. The issue is fixed in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-58444
GHSA-cp3q-vrj2-ghhh
GO-2026-6050

Timeline

2026-07-13: disclosed
2026-07-21: advisory
1.27.0: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.