🚨 CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

🎖@cveNotify

🚨 CVE-2026-58431
Public-only API token restriction is not enforced on team API routes

🎖@cveNotify

🚨 CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

🎖@cveNotify

🚨 CVE-2026-58433
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

🎖@cveNotify

🚨 CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation

🎖@cveNotify

🚨 CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation

🎖@cveNotify

🚨 CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

🎖@cveNotify

🚨 CVE-2026-58437
Repository Visibility Manipulation via Git Push Options

🎖@cveNotify

🚨 CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

🎖@cveNotify

🚨 CVE-2026-58439
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

🎖@cveNotify

🚨 CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

🎖@cveNotify

🚨 CVE-2026-58441
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

🎖@cveNotify

🚨 CVE-2026-58442
Repository migration SSRF via multi-answer DNS allow-list bypass

🎖@cveNotify

🚨 CVE-2026-58443
Public-only repository tokens can update private PR head branches

🎖@cveNotify

🚨 CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

🎖@cveNotify

🚨 CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

🎖@cveNotify

🚨 CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

🎖@cveNotify

🚨 CVE-2026-58510
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

🎖@cveNotify

🚨 CVE-2026-58511
Webhook Authorization Header Returned in Plaintext via API

🎖@cveNotify

🚨 CVE-2026-59109
SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string concatenation, with neither parameterised queries nor escaping. The
application's own escaping helper, Dazadi.sql_txt(),
is not invoked on these code paths, so a party that sends an invoice can break
out of the string literal and alter the query logic.









This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

🎖@cveNotify

🚨 CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

🎖@cveNotify