CVE-2026-58429 is a vulnerability in Gitea affecting versions before 1.27.0. Personal access tokens restricted to the public-only scope can bypass intended access controls on organization and permission-related API endpoints. This is caused by inconsistent middleware enforcement and route-specific authorization failures, allowing retrieval of private organization membership and permission details for the token owner's account. Direct access to private organizations is blocked, but indirect endpoints such as user organization listings and permission queries do not consistently enforce the public-only restriction, exposing private data.

An attacker with a personal access token scoped to public-only can access private organization membership and permission details indirectly via certain API endpoints. This exposure compromises confidentiality of private organization data related to the token owner's account. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild.

A patch is available for this vulnerability. Users should upgrade Gitea to version 1.27.0 or later to remediate the issue. Since this is not a cloud service, remediation requires applying the patch on self-hosted instances. No additional mitigation steps are indicated.