CVE-2026-58438
CVE-2026-58438: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-58438] Unauthorized tampering and commenting on private repositories via insecure direct object reference
CVE-2026-58438Source published Source updated
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference (IDOR), exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private repository they are not authorized to access. This allows the attacker to tamper with issue-tracking states and inject comments into private repositories, leading to unauthorized write operations across private repository boundaries. Due to insufficient authorization checks, a remote user with issue-write access in one repository can manipulate dependency relations…
- Affected products in this advisory
- OpenShift Pipelines
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 1.27.0
- Mitigation guidance
- To mitigate this issue, restrict write access to repository issues to trusted users, or temporarily disable issue tracking on affected repositories until a patch is applied.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.