CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Scoring

Severity

MEDIUM

CVSS base score

4.9

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.35%

CWE

CWE-284, CWE-1259

Published

2026-08-13

Last modified

2026-08-14

Affected products

• Gitea Gitea Open Source Git Server

Weakness type

• CWE-284
• CWE-1259

Related vulnerabilities

• CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
• CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
• CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
• CVE-2026-75998 — ColdFusion | Improper Access Control (CWE-284)
• CVE-2026-86672 — ningzichun Student Management System Backup example.7z information disclosure
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
• CVE-2026-77487 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-73028 — SQL Server Elevation of Privilege Vulnerability

Markdown version · Browse all CVEs