{"id":"EUVD-2026-41607","enisaUuid":"02f49ae3-a8c9-3ce2-9917-228bd12aebca","description":"Permanent Fork PR Workflow Approval Gate Bypass","datePublished":"Jul 3, 2026, 8:54:52 PM","dateUpdated":"Jul 6, 2026, 3:09:01 PM","baseScore":8.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-777r-4v59-6486\nhttps://github.com/go-gitea/gitea/pull/38010\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-58424\nGHSA-777r-4v59-6486\n","assigner":"Gitea","epss":0.25,"enisaIdProduct":[{"id":"85ce2f47-d800-303d-bd94-a7c0564bbf49","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"enisaIdVendor":[{"id":"c6ffcfb1-6441-38da-8843-f36d8ae94a72","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"5ea47b4e-5193-35a0-9f66-f2dafeaa72c5","vulnerability":{"id":"CVE-2026-58424","description":"Permanent Fork PR Workflow Approval Gate Bypass","datePublished":"Jul 3, 2026, 8:54:52 PM","dateUpdated":"Jul 6, 2026, 3:09:01 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-777r-4v59-6486\nhttps://github.com/go-gitea/gitea/pull/38010\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41607\n","assigner":"Gitea","epss":0.25,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"c153dec6-c3fd-3fdc-82d3-f754197543d6","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"vulnerabilityVendor":[{"id":"38149eda-0eed-3182-a9cd-0bc244a2771d","vendor":{"name":"Gitea"}}]}},{"id":"78647920-43f7-3965-8673-df3db3c8a704","vulnerability":{"id":"GHSA-777r-4v59-6486","description":"Gitea: Permanent Fork PR Workflow Approval Gate Bypass","datePublished":"Jul 21, 2026, 8:35:51 PM","dateUpdated":"Jul 21, 2026, 8:35:51 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-777r-4v59-6486\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58424\nhttps://github.com/go-gitea/gitea/pull/38010\nhttps://github.com/go-gitea/gitea/commit/699fe2ef43b9466ac1b0cb857029f91fd5b0056d\nhttps://github.com/go-gitea/gitea/commit/e107498f3b6fccff35455ef17430ca68df665297\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\n","enisa_id":"EUVD-2026-41607\n","aliases":"GHSA-777r-4v59-6486\nCVE-2026-58424\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:58:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}