CVE-2026-58437: Gitea: Repository Visibility Manipulation via Git Push Options

Gitea’s post-receive git hook handler processes git push options — key-value pairs transmitted by a client during git push using the -o flag. Two undocumented push options, repo.private and repo.template, allow any user with repository owner or admin-collaborator access to toggle the visibility (private/public) and template status of a repository as a side effect of a normal git push.

This capability was originally intended solely for the “push-to-create” feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger:

• No entry written to the repository’s audit/activity log
• No webhook event fired (repository event with visibility_changed action)
• No org-level notification to owners
• No team permission re-calculation
• No email alert to watchers
• The database update uses UpdateRepositoryColsNoAutoTime, which also suppresses the updated_at timestamp change