Public-only Repository Token Privilege Escalation in GitHub

Executive Summary

CVE-2026-58443 is a critical vulnerability in Gitea versions up to v1.26.4. It allows a public-only write token to update a private pull request head branch via a public base repository route. The issue occurs because Gitea checks the token's public-only restriction against the public base repository but fails to reapply this restriction when updating the private head repository.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea version with 'gitea --version' or via admin panel. Inspect pull request branches in private repositories for unauthorized updates from public repositories. Review token scopes for public-only and write:repository permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid token can push public base commits into a private head branch, bypassing direct private repository write restrictions. This grants write access to the private repository, compromising its integrity. If Actions is enabled, the attack also triggers workflow execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of private repositories, which may contain sensitive data. For GDPR, this could result in unauthorized processing or disclosure of personal data, violating principles of data protection and user rights. For HIPAA, it may expose protected health information (PHI) to unauthorized individuals, compromising confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version v1.26.5 or later. Revoke public-only tokens with write:repository scopes. Disable Actions on private repositories if not needed. Monitor private repository branches for unauthorized changes.

Useful 0 Not Useful 0