CVE-2026-58416

HIGH

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-58416 has a selected CVSS score of 7.1 (high).

Description

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Gitea Open Source Git Server

Browse Gitea / Gitea Open Source Git Server

Default status: unaffected

CVE ListThrough 1.26.4affected

gitea.dev

Browse Go / gitea.dev
GitHub AdvisoryBefore 1.27.0 · Fixed in 1.27.0affected

References

6