CVE-2026-58438 is a cross-repository IDOR in issue-dependency management that allows manipulation of issue relationships in private repositories the attacker cannot legitimately access. The vulnerability is not a typical IDOR scoped within an authorized domain — it pierces repository boundaries entirely, enabling an attacker to both remove dependencies and inject comments into private repos they have no access to. This is a complete trust-model violation, not a privilege escalation within a boundary the attacker already occupies.
The CVSS 7.5 rating is likely understated. CVSS struggles to capture logical access control failures that operate through application-layer pathways rather than memory corruption, and it has no vocabulary for multi-tenant scenarios where the same infrastructure serves multiple organizations. An attacker commenting inside your private repo operates with implicit system authority that bypasses every external perimeter control. That comment can seed social engineering attacks with surgical precision — referencing actual project IDs and dependency graphs the victim can verify — or encode information about your internal structure that was never meant to be observable from outside. The write-capable nature of this vulnerability fundamentally changes the risk calculus compared to read-only IDORs.
Audit trail visibility is a critical unknown. Issue-dependency modifications may look like normal feature usage, leaving defenders unable to distinguish tampering from legitimate workflow. This architectural invisibility is what makes these vulnerabilities attractive to sophisticated actors pursuing low-and-slow positioning strategies.
For defenders: prioritize patching the dependency-removal endpoint immediately. However, the systemic fix requires more than a single patch — examine whether your issue-tracking system treats internal API callers as implicitly trustworthy across authorization domains. Audit your audit logs to determine whether dependency modifications produce clear forensic signatures. Treat the EPSS score of 0.00268 as a floor, not a ceiling: issue-tracking IDORs have long exploitation tails precisely because detection is poor. The real question isn't whether exploitation is likely in the next 30 days — it's what damage results if even one sophisticated attacker achieves it, and that expected loss isn't reflected in current scoring.