{"action":"Upgrade code.gitea.io/gitea to 1.27.0 or later.","affected":[{"fixed":"1.27.0","introduced":"0"}],"component":"code.gitea.io/gitea","cve_ids":["CVE-2026-58434"],"ecosystem":"Go","epss":0.00466,"exploited":false,"fixed_versions":["1.27.0"],"ghsa_id":"GHSA-j2w3-9c3r-g83q","id":"tcs_01M5KFDB0YEVTF15B33DWHYCB7","modified_at":"2026-07-27T17:11:16.838840584Z","published_at":"2026-07-21T20:41:49Z","references":["https://osv.dev/vulnerability/GHSA-j2w3-9c3r-g83q","https://github.com/go-gitea/gitea/security/advisories/GHSA-j2w3-9c3r-g83q","https://github.com/go-gitea/gitea/pull/38321","https://github.com/go-gitea/gitea/pull/38390","https://github.com/go-gitea/gitea/commit/362539b78e50dfcc4bd1b9368fdd2a1b8cab0129","https://github.com/go-gitea/gitea/commit/500a09e044156d7a8d6eb58d67a28b8a1512c887","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.27.0"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-j2w3-9c3r-g83q","url":"https://osv.dev/vulnerability/GHSA-j2w3-9c3r-g83q"}],"summary":"Gitea: Private Repository Metadata Remains Accessible After Access Revocation"}