The vulnerability in Gitea (CVE-2026-58444) is a token scope enforcement bypass affecting the repository home page route handler 'repo.Home'. While other web routes serving private repository content enforce the presence of the 'repository' scope on personal access tokens or OAuth2 tokens, the repository home page route does not perform this check. Tokens lacking the 'repository' scope or marked as public-only can still access private repository metadata and content rendered on the home page, including README files and directory listings. This issue arises because the 'repo.Home' handler only verifies user permissions but does not validate the token's scope, unlike sibling handlers that call the scope guard 'context.CheckRepoScopedToken'. The vulnerability was confirmed on Gitea versions before 1.27.0 with proof-of-concept demonstrating private content disclosure using tokens without repository scope.

An attacker with a personal access token or OAuth2 token lacking the 'repository' scope can access private repository information via the repository home page route. This includes sensitive data such as the rendered README, root file and directory listings, repository description, language statistics, license information, and latest release details. The vulnerability does not allow modification or deletion of repository content but results in unauthorized information disclosure of private repositories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using personal access tokens or OAuth2 tokens without the 'repository' scope to access private repository content. Monitor vendor channels for updates regarding a patch or official fix addressing this token scope enforcement bypass on the repository home page route.