CVE-2026-79960

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79960

EUVD

EUVD-2026-93918

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a user with a writable deploy key to bypass permission checks. When pushing changes, the system incorrectly attributes the action to the repository owner instead of the deploy key holder. This enables the deploy key holder to create protected tags without being on the allow list and change repository visibility, such as making a private repository public. Pull requests created via the AGit flow with a deploy key are also attributed to the owner.

Detection Guidance

To detect this vulnerability, check Gitea server logs for unauthorized changes to repository visibility or protected tags. Look for push events using deploy keys that modify these settings. Verify if deploy keys are stored in plaintext or if token prefixes are missing in secret scans.

Impact Analysis

If you use Gitea with deploy keys, an attacker with access to a writable deploy key could alter repository settings, expose private data by changing visibility, or create unauthorized tags. This could lead to data leaks, unauthorized changes, or compliance violations depending on your use case.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using Gitea must ensure proper access controls to maintain compliance.

Mitigation Strategies

Review deploy key permissions and revoke any unnecessary keys. Check repository settings for unauthorized changes to visibility or protected tags. Audit push hook pipelines for incorrect permission evaluations.

Hi! I’m here to help you understand CVE-2026-79960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70