CVE-2026-58437
published 2026-08-13CVE-2026-58437: Repository Visibility Manipulation via Git Push Options
PriorityP335high7.1CVSS 3.1
AVNACLPRLUINSUCLIHAN
EPSS
0.19%
9.3th percentile
Repository Visibility Manipulation via Git Push Options
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Repository visibility manipulation via Git push options
vendor_redhat·2026-08-13·CVSS 7.1
CVE-2026-58437 [HIGH] CWE-1220 code.gitea.io/gitea: Gitea: Repository visibility manipulation via Git push options
code.gitea.io/gitea: Gitea: Repository visibility manipulation via Git push options
Repository Visibility Manipulation via Git Push Options
A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes.
Package: openshift-pipelines-client (OpenShift Pipelines) - Affected
Package: openshift-pipelines/pipelines-cli-tkn-rhel9 (OpenShift Pipelines) - Affected
Package: openshift-pipelines/pipelines-opc-rhel9 (OpenShift Pipelines) - Affected
Package: openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (OpenShift Pipelines) - Affected
Package: openshift-pipelines/pipelines-pipelines-as-code-c
GHSA
Gitea: Repository Visibility Manipulation via Git Push Options
ghsa·2026-07-21
CVE-2026-58437 [HIGH] CWE-284 Gitea: Repository Visibility Manipulation via Git Push Options
Gitea: Repository Visibility Manipulation via Git Push Options
### Repository Visibility Manipulation via Git Push Options
| Field | Value |
|-------|-------|
| **Affected File** | `routers/private/hook_post_receive.go` |
| **Affected Function** | `HookPostReceive()` |
| **Affected Lines** | 173–225 |
| **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target repository |
---
#### Description
Gitea's post-receive git hook handler processes git push options — key-value pairs transmitted by a client during `git push` using the `-o` flag. Two undocumented push options, `repo.private` and `repo.template`, allow any user with repository owner or admin-collaborator access to toggle the visibility (`private/public`) and template status of a repository as a
No detection rules found.
No public exploits indexed.
2026-08-13
Published