CVE-2026-58439: Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Gitea does not re-evaluate the official flag on existing pull request reviews when a PR’s target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., master). The approval, which would have been official: false if submitted against the protected branch, is preserved and satisfies the protected branch’s required approvals, allowing the attacker to merge without legitimate maintainer approval.
- Confirmed on Gitea 1.25.4 (
1.25.4+41-g96515c0f20)
References
- github.com/advisories/GHSA-w5pg-649r-p6gg
- github.com/go-gitea/gitea/commit/74ad781db9c37134ee9280c69a6b1de53801503e
- github.com/go-gitea/gitea/commit/8401fe7c544abff1ecc49d7f3166fd4ee0c174ef
- github.com/go-gitea/gitea/pull/38319
- github.com/go-gitea/gitea/pull/38402
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg
- nvd.nist.gov/vuln/detail/CVE-2026-58439
Code Behaviors & Features
Detect and mitigate CVE-2026-58439 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →