CVE-2026-58438 is a cross-repository IDOR vulnerability in Gitea versions prior to 1.27.0. The flaw arises because the RemoveDependency function does not enforce proper permission checks when removing issue dependencies across repositories, unlike the AddDependency function. An attacker with write access to issues in one repository can exploit this to remove dependencies and post comments on issues in private repositories they cannot access, effectively tampering with private repository data without authorization.

An attacker with limited write access to issues in one repository can manipulate issue dependencies and inject comments into issues of private repositories they do not have read or write access to. This unauthorized modification could lead to information disclosure or disruption of issue tracking in private repositories. The severity is rated low due to the requirement of existing write access and the complexity of exploitation.

A patch is available that fixes this vulnerability in Gitea version 1.27.0. Users should upgrade to version 1.27.0 or later to remediate this issue. No additional mitigation actions are required beyond applying the official fix.