Gitea allows a token with `public-only,write:repository` restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against the public base repository route but fails to re-apply this restriction to the private head repository during the update process. Consequently, an attacker with such a token can cause Gitea to push commits from a public base repository into a private head branch, bypassing the intended access limitations.
Technical details include:
- **API Endpoint:** `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`
- **Vulnerable Function:** `UpdatePullRequest()`
If Gitea Actions is enabled on the private head repository, this unauthorized push can also trigger the execution of private repository `push` workflows.