CVE-2026-58507: Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

July 21, 2026

Field	Value
Affected File	`routers/web/repo/githttp.go`, `services/context/repo.go`
Affected Functions	`httpBase()`, `EarlyResponseForGoGetMeta()`
Affected Lines	`githttp.go:63–66`, `services/context/repo.go:374–396`
Prerequisite	None — fully unauthenticated

References

github.com/advisories/GHSA-p4mj-98mv-xq26
github.com/go-gitea/gitea/releases/tag/v1.27.0
github.com/go-gitea/gitea/security/advisories/GHSA-p4mj-98mv-xq26
nvd.nist.gov/vuln/detail/CVE-2026-58507

Code Behaviors & Features

Detect and mitigate CVE-2026-58507 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →