PT-2026-63305 · Gitea+1 · Gitea+1

Yonatan-Pl

·

CVE-2026-58439

·

Published

2026-07-21

·

Updated

2026-08-14

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0
Description Gitea fails to re-evaluate the official flag on existing pull request reviews when the target branch of a pull request is changed. An attacker with write access to a repository can obtain an official: true approval on a pull request targeting an unprotected branch and then retarget that pull request to a protected branch. Because the system does not re-verify if the reviewer is in the new target branch's approval whitelist, the stale approval is preserved. This allows the attacker to satisfy protected branch requirements and merge changes without legitimate maintainer approval, effectively bypassing branch protection and escalating privileges.
Technical details include the following:
  • API Endpoints: /api/v1/repos/{owner}/{repo}/pulls and /api/v1/repos/{owner}/{repo}/pulls/{index}/reviews are used during the exploitation process.
  • Vulnerable Parameters or Variables: The official flag is stored as a boolean on the review record and is not updated during the ChangeTargetBranch process.
  • Function Names: The issue involves IsUserOfficialReviewer(), ChangeTargetBranch(), and GetGrantedApprovalsCount(), which fails to re-check the whitelist against the new branch.
Recommendations Update Gitea to version 1.27.0 or later. As a temporary mitigation, restrict write access to repositories to only trusted users to prevent unauthorized retargeting of pull requests.

Exploit

Fix

Improper Access Control

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-284CWE-863

Related Identifiers

CVE-2026-58439
GHSA-W5PG-649R-P6GG
GO-2026-6080
OPENSUSE-SU-2026:21551-1
SUSE-SU-2026:23216-1
SUSE-SU-2026:23227-1

Affected Products

Gitea
Red Os