Gitea.dev: Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) (CVE-2026-58416)
Gitea versions prior to 1.27.0 contain a vulnerability where a fork pull-request Actions workflow can read a third private repository if that repository trusts the fork's base repository owner as a collaborative owner. This occurs due to a missing permission guard against fork pull-requests in the collaborative-owner branch, resulting in unauthorized read access. The vulnerability leads to a confidentiality breach exposing the full source code of a private repository to an untrusted fork PR author. A patch is available to address this issue.
AI Analysis
Technical Summary
CVE-2026-58416 is a vulnerability in Gitea before version 1.27.0 where the permission check for Actions tasks does not properly guard against fork pull-requests in the collaborative-owner branch. This flaw allows a fork pull-request Actions workflow to read a third private repository if that repository trusts the fork's base repository owner as a collaborative owner. The vulnerability results in unauthorized read-only access to the full source code of a private repository, constituting a confidentiality breach. The issue is tracked under CWE-280 (Improper Access Control) and CWE-863 (Incorrect Authorization).
Potential Impact
The vulnerability enables an untrusted fork pull-request author to gain read-only access to the full source code of a third private repository that trusts the fork's base repository owner as a collaborative owner. This leads to a confidentiality breach but does not affect integrity or availability.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that fixes this vulnerability by adding the missing permission guard against fork pull-requests in the collaborative-owner branch. Users should upgrade to version 1.27.0 or later to remediate this issue.
Gitea.dev: Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) (CVE-2026-58416)
Description
Gitea versions prior to 1.27.0 contain a vulnerability where a fork pull-request Actions workflow can read a third private repository if that repository trusts the fork's base repository owner as a collaborative owner. This occurs due to a missing permission guard against fork pull-requests in the collaborative-owner branch, resulting in unauthorized read access. The vulnerability leads to a confidentiality breach exposing the full source code of a private repository to an untrusted fork PR author. A patch is available to address this issue.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58416 is a vulnerability in Gitea before version 1.27.0 where the permission check for Actions tasks does not properly guard against fork pull-requests in the collaborative-owner branch. This flaw allows a fork pull-request Actions workflow to read a third private repository if that repository trusts the fork's base repository owner as a collaborative owner. The vulnerability results in unauthorized read-only access to the full source code of a private repository, constituting a confidentiality breach. The issue is tracked under CWE-280 (Improper Access Control) and CWE-863 (Incorrect Authorization).
Potential Impact
The vulnerability enables an untrusted fork pull-request author to gain read-only access to the full source code of a third private repository that trusts the fork's base repository owner as a collaborative owner. This leads to a confidentiality breach but does not affect integrity or availability.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that fixes this vulnerability by adding the missing permission guard against fork pull-requests in the collaborative-owner branch. Users should upgrade to version 1.27.0 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fj8v-hjwv-qm88
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58416"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a600ab79c2644c7f8fe24e2
Added to database: 07/22/2026, 00:11:35 UTC
Last enriched: 08/14/2026, 12:55:32 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.