CVE-2026-58434

This vulnerability exposes a systematic blind spot in modern repository systems: when user access is revoked, content tokens are invalidated but metadata caches persist, leaving a side-channel where the existence, structure, and naming of supposedly private repositories remains queryable. The failure isn't in your access control logic — it's in the infrastructure assumption that metadata is cheap, cacheable, and independent of user context. The practical risk is severe. While content exposure is bounded (attacker sees what was cached), metadata leakage is generative — it reveals organizational structure, naming conventions, project timelines, and internal priorities without exfiltrating a single byte. Repository names like "acquisition-target-q3" or "project-dead-end" are themselves sensitive intelligence. An attacker doesn't need your source code to construct a credible reconnaissance profile for social engineering or competitive intelligence. Your revocation tests almost certainly verify content inaccessibility and miss metadata surfaces. Check whether your API exposes separate metadata endpoints (listings, search, autocomplete, pagination) that bypass content access controls. The cognitive gap is real: engineers testing revocation have no obvious reason to suspect that revoking read access doesn't revoke list access. On legacy or deprecated API surfaces, this gap is almost certainly worse. Deprecation often means the revocation logic was never ported when the active code moved to new endpoints. Treat your deprecation strata as permanent blind spots until proven otherwise. The fix requires treating metadata about private resources as fundamentally uncacheable per-user when access controls are dynamic, with narrow exceptions. The performance cost is bounded (queryable metadata, not high-frequency content), while the security benefit is asymmetric — caching creates an information disclosure surface that scales with revoked users and private repositories. Beyond patching this specific CVE, you need to own the invalidation boundary between content access and metadata visibility as a single security surface, not two independent concerns.

Reviewed through automated stages and approved by a human before publication.