Bircni

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.27.0 **Description** Gitea allows a token with `public-only,write:repository` restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against the public base repository route but fails to re-apply this restriction to the private head repository during the update process. Consequently, an attacker with such a token can cause Gitea to push commits from a public base repository into a private head branch, bypassing the intended access limitations. Technical details include: - **API Endpoint:** `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update` - **Vulnerable Function:** `UpdatePullRequest()` If Gitea Actions is enabled on the private head repository, this unauthorized push can also trigger the execution of private repository `push` workflows. **Recommendations** Update Gitea to version 1.27.0.