Gitea before version 1.27.0 improperly handles the '?go-get=1' query parameter by bypassing authentication and authorization checks. This results in HTTP 200 responses containing go-import and go-source meta tags for private repositories, enabling unauthenticated attackers to confirm private repository existence, enumerate repository names, and harvest clone URLs and default branch names. The vulnerability is identified as CVE-2026-58507 and is categorized under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). The flaw impacts the code.gitea.io/gitea product and has a CVSS 3.1 score of 5.3 (medium severity).

The vulnerability allows unauthenticated attackers to confirm the existence of private repositories and gather sensitive metadata such as repository names, clone URLs, and default branch names. This information disclosure could aid attackers in reconnaissance but does not directly allow modification or deletion of repository data. There are no known exploits in the wild at this time.

A patch is available for Gitea that fixes this issue in version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the official fix. No alternative mitigations are indicated by the vendor advisory.