Is CVE-2026-58510 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58510 being exploited in the wild.

How severe is CVE-2026-58510?

Medium severity, with a CVSS score of 4.3, published 21 July 2026.

Which products and versions are affected?

Gitea >= 1.25.4, < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-58510?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58510 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58510?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58510: Gitea information disclosure via stale watches in REST API

Q: Which products and versions are affected?

Gitea >= 1.25.4, < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-58510?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58510 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-58510?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58510 · Severity: medium · CVSS 4.3 · Published 2026-07-21

Gitea, a popular self-hosted Git service, contains a flaw where changing a public repository to private via the API fails to remove existing 'watchers.' This means that users who were watching the repository while it was public can still see sensitive metadata—such as descriptions, branch names, and activity counts—even after they should have lost access. This primarily affects organizations using automated tools or scripts to manage repository privacy.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58510 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58510 being exploited in the wild.
How severe is CVE-2026-58510?: Medium severity, with a CVSS score of 4.3, published 21 July 2026.
Which products and versions are affected?: Gitea >= 1.25.4, < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-58510?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58510 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58510?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

A vulnerability exists in Gitea's repository update logic where the 'ClearRepoWatches' cleanup task is missing from the API-driven code path. While the web UI correctly triggers this cleanup in 'MakeRepoPrivate', the REST API path (PATCH /api/v1/repos/{owner}/{repo}) calls 'updateRepository', which only clears repository stars. Consequently, stale watch records persist for users who watched the repo while it was public. These users can then access full repository JSON metadata (description, default branch, license, etc.) via the '/api/v1/user/subscriptions' endpoint despite having no formal access to the private repository. The issue was introduced by an incomplete fix for a previous vulnerability (GHSA-8fwc-qjw5-rvgp) and is resolved in version 1.27.0.

Affected products

Gitea Gitea >= 1.25.4, < 1.27.0

Identifiers

CVE-2026-58510
GHSA-q423-49rw-g9mh
GO-2026-6069

Timeline

2026-05-16: other: Vulnerability confirmed present in master branch HEAD
2026-07-13: advisory: Initial GitHub Advisory published
2026-07-21: disclosed: CVE-2026-58510 assigned and published
1.27.0: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.