CVE-2026-58431

9th percentile - higher than 9% of all known CVEs

The public-only API token restriction is not enforced on team API routes. This means a token intended for public access only can access team data that should be private.

This can lead to unauthorized disclosure of team information, compromising confidentiality and potentially aiding attackers in further attacks.

Update Gitea to a patched version and verify API token configurations to ensure restrictions are enforced on all routes. Monitor token usage.