CVE-2026-58439: Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Gitea does not re-evaluate the official flag on existing pull request reviews when a PR’s target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., master). The approval, which would have been official: false if submitted against the protected branch, is preserved and satisfies the protected branch’s required approvals, allowing the attacker to merge without legitimate maintainer approval.
- Confirmed on Gitea 1.25.4 (
1.25.4+41-g96515c0f20)
References
- github.com/advisories/GHSA-w5pg-649r-p6gg
- github.com/go-gitea/gitea/commit/74ad781db9c37134ee9280c69a6b1de53801503e
- github.com/go-gitea/gitea/commit/8401fe7c544abff1ecc49d7f3166fd4ee0c174ef
- github.com/go-gitea/gitea/pull/38319
- github.com/go-gitea/gitea/pull/38402
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg
- nvd.nist.gov/vuln/detail/CVE-2026-58439
Code Behaviors & Features
Detect and mitigate CVE-2026-58439 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →