high7.5
CVE-2026-58438
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Impact
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | gitea.dev | < 1.27.0 | 1.27.0 |