Loading story…
A critical Gitea authorization bypass tracked as CVE-2026-58443 allows a public-only access token with write:repository scope to push commits into a private repository under specific pull request conditions. The flaw affects Gitea releases up to and including v1.26.4 and was fixed in v1.27.0. Researchers said the issue lies in the pull request update endpoint, where Gitea checks the token’s public-only restriction against the public base repository but fails to enforce that restriction again when operating on the private head repository.
The bug can be abused to perform unauthorized server-side merges or rebases into a private pull request head branch, and those writes may also trigger Gitea Actions workflows on the private repository if Actions is enabled. Public reporting included a technical analysis and a working proof-of-concept, though no confirmed in-the-wild exploitation was cited. Administrators were urged to upgrade to v1.27.0, audit and rotate or revoke public-only tokens with write permissions, review public-to-private pull request relationships, and inspect recent private repository pushes and Actions logs for suspicious activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed CVE-2026-58443 as a critical authorization bypass in Gitea, explaining that public-only tokens with write:repository scope could indirectly write to private pull request head branches and trigger private workflows when Actions is enabled. The disclosure also reiterated upgrade and token-audit recommendations for administrators.
Gitea addressed CVE-2026-58443 in v1.27.0. The vulnerability affected all releases up to and including v1.26.4 and allowed a public-only token to write to a private repository under specific pull request conditions.
Researchers published technical details and working proof-of-concept code for CVE-2026-58443, showing how the pull request update endpoint could be abused to push commits into a private repository and potentially trigger Gitea Actions workflows. The available reporting noted no confirmed in-the-wild exploitation in the cited content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
Gitea has patched a critical remote code execution flaw, **CVE-2026-60004**, affecting versions `1.17` through `1.27.0`, after researchers showed that attacker-controlled patch content sent to the `POST /api/v1/repos/{owner}/{repo}/diffpatch` endpoint could be turned into a malicious Git hook and executed as the Gitea service account. The bug carries a **CVSS 9.8** rating and stems from patch application inside a shared bare temporary clone, where Git's three-way fallback can activate the planted hook; exploitation also depends on **Git 2.32 or later**. Gitea fixed the issue in **version 1.27.1** and said its cloud instances would be upgraded automatically.
Aug 3, 2026
A critical flaw in **Gitea `act_runner`** and a separate compromise of popular **GitHub Actions** highlighted how CI/CD platforms can be turned into high-impact attack paths. In Gitea, **`CVE-2026-58053`** allows a user with workflow execution privileges to escape a Docker-backed job container and gain **root access on the host** by abusing unsafe Docker options merged from `container.options`, including `--pid=host`, `--cap-add`, and `--security-opt`. The issue affects Docker-backed `act_runner` deployments through version `0.262.0`, putting source code, build systems, and deployment credentials at risk. In the GitHub ecosystem, attackers compromised tags for **`tj-actions/changed-files`** and several **reviewdog** actions in a supply-chain campaign tracked as **`CVE-2025-30066`** and **`CVE-2025-30154`**, causing CI/CD secrets to be written into workflow logs and potentially exposed, especially in public repositories. Reporting tied the activity to an intrusion that likely began with Coinbase-related targets before expanding more broadly. Defenders were urged to upgrade vulnerable Gitea runners, restrict workflow container options, audit workflows and logs, remove affected actions, rotate exposed secrets, preserve and then delete compromised logs, and pin GitHub Actions to full commit hashes.
Jul 7, 2026