CVE-2026-58443

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0

Description Gitea allows a token with public-only,write:repository restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against the public base repository route but fails to re-apply this restriction to the private head repository during the update process. Consequently, an attacker with such a token can cause Gitea to push commits from a public base repository into a private head branch, bypassing the intended access limitations.

Technical details include:

If Gitea Actions is enabled on the private head repository, this unauthorized push can also trigger the execution of private repository push workflows.

Recommendations Update Gitea to version 1.27.0.