medium4.3
CVE-2026-58444
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Impact
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.27.0 | 1.27.0 |