Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)

Gitea's post-receive git hook handler accepts undocumented push options (`repo.private`, `repo.template`) that allow any user with owner or admin-collaborator access to silently toggle a repository's visibility and template status during a normal `git push`. The change bypasses audit logging, webhook events, org notifications, team permission recalculation, and timestamp updates, leaving no distinguishable trace in the activity feed. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-8p9h-49rc-qgxj Details: https://vuln.today/cve/CVE-2026-58437