Gitea: Private Repository Metadata Remains Accessible After Access Revocation (CVE-2026-58434)
A vulnerability in Gitea allows a user who previously had access to a private repository to continue accessing repository metadata via the starred repository API endpoint after their access has been revoked. Although direct repository access is denied, the repository still appears in the user's starred list with updated metadata such as name, description, and visibility status. The issue does not expose repository contents, source code, or sensitive collaborator information.
AI Analysis
Technical Summary
CVE-2026-58434 describes a vulnerability in Gitea versions prior to 1.27.0 where a user removed from a private repository's collaborators can still retrieve repository metadata through authenticated API endpoints like GET /api/v1/user/starred and GET /api/v1/user/subscriptions. Despite losing direct access (which returns 404), the repository remains listed in the user's starred repositories with metadata that reflects changes made after access revocation. This metadata includes repository name, description, and private status but excludes sensitive content or collaborator details.
Potential Impact
The impact is limited to unauthorized continued access to private repository metadata after access revocation. No repository contents, source code, issues, pull requests, secrets, or collaborator information are exposed. This could lead to unintended disclosure of repository existence and descriptive information to former collaborators.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this metadata exposure risk when revoking collaborator access. Monitoring vendor communications for patches or updates is recommended.
Gitea: Private Repository Metadata Remains Accessible After Access Revocation (CVE-2026-58434)
Description
A vulnerability in Gitea allows a user who previously had access to a private repository to continue accessing repository metadata via the starred repository API endpoint after their access has been revoked. Although direct repository access is denied, the repository still appears in the user's starred list with updated metadata such as name, description, and visibility status. The issue does not expose repository contents, source code, or sensitive collaborator information.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58434 describes a vulnerability in Gitea versions prior to 1.27.0 where a user removed from a private repository's collaborators can still retrieve repository metadata through authenticated API endpoints like GET /api/v1/user/starred and GET /api/v1/user/subscriptions. Despite losing direct access (which returns 404), the repository remains listed in the user's starred repositories with metadata that reflects changes made after access revocation. This metadata includes repository name, description, and private status but excludes sensitive content or collaborator details.
Potential Impact
The impact is limited to unauthorized continued access to private repository metadata after access revocation. No repository contents, source code, issues, pull requests, secrets, or collaborator information are exposed. This could lead to unintended disclosure of repository existence and descriptive information to former collaborators.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this metadata exposure risk when revoking collaborator access. Monitoring vendor communications for patches or updates is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j2w3-9c3r-g83q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58434"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a600ab79c2644c7f8fe24c8
Added to database: 07/22/2026, 00:11:35 UTC
Last enriched: 07/22/2026, 00:49:02 UTC
Last updated: 07/22/2026, 01:34:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.