CVE-2026-58432: CWE-200 in Gitea Gitea Open Source Git Server
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
AI Analysis
Technical Summary
Gitea before version 1.27.0 has an authorization bypass vulnerability (CVE-2026-58432) affecting draft release attachments. While draft releases are hidden from listings and API queries, the web-level UUID-based URLs for attachments do not enforce draft status checks. The web handler only verifies read permissions on the repository but fails to confirm if the release is a draft, allowing anyone with the UUID to access and download draft attachments. This discrepancy between API and web endpoint authorization leads to unauthorized disclosure of potentially sensitive draft release data. The vulnerability has a CVSS 3.1 score of 5.9 (medium severity) and is patched in version 1.27.0.
Potential Impact
Unauthorized users can access and download draft release attachments if they obtain the UUID, potentially exposing sensitive information not intended for public release. The vulnerability does not allow modification or deletion, only unauthorized read access to draft attachments. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official patch is available in Gitea version 1.27.0 that fixes this authorization bypass. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until patched, restrict access to UUIDs of draft release attachments and avoid sharing them publicly.
CVE-2026-58432: CWE-200 in Gitea Gitea Open Source Git Server
Description
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Gitea before version 1.27.0 has an authorization bypass vulnerability (CVE-2026-58432) affecting draft release attachments. While draft releases are hidden from listings and API queries, the web-level UUID-based URLs for attachments do not enforce draft status checks. The web handler only verifies read permissions on the repository but fails to confirm if the release is a draft, allowing anyone with the UUID to access and download draft attachments. This discrepancy between API and web endpoint authorization leads to unauthorized disclosure of potentially sensitive draft release data. The vulnerability has a CVSS 3.1 score of 5.9 (medium severity) and is patched in version 1.27.0.
Potential Impact
Unauthorized users can access and download draft release attachments if they obtain the UUID, potentially exposing sensitive information not intended for public release. The vulnerability does not allow modification or deletion, only unauthorized read access to draft attachments. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official patch is available in Gitea version 1.27.0 that fixes this authorization bypass. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until patched, restrict access to UUIDs of draft release attachments and avoid sharing them publicly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q9pg-jj6x-j9p6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58432"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a600abb9c2644c7f8fe2bb6
Added to database: 07/22/2026, 00:11:39 UTC
Last enriched: 08/14/2026, 12:58:43 UTC
Last updated: 09/07/2026, 10:52:09 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.