Unrated

Authorization bypass in Gitea pull request update API

IdentifiersCVE-2026-58443CWE-863

CVE-2026-58443 is a critical incorrect authorization vulnerability in Gitea affecting versions up to and including 1.26.4. The flaw resides in the pull request update API endpoint used to update pull requests. Gitea validates a public-only repository access token against the public base repository referenced in the API route, but fails to reapply the token’s public-only restriction when the operation later accesses the private head repository associated with the pull request. As a result, a token that is intended to be limited to public repositories can indirectly cause server-side merge or rebase operations that write commits into a private branch. The issue does not provide anonymous access to private repositories, but it breaks the intended security boundary of public-only tokens by allowing indirect modification of private repository content through the pull request update path.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthorized writes to a private repository branch through server-side pull request update operations, despite the token being restricted to public repositories. This can compromise repository integrity by injecting commits into private branches and can also affect availability if malicious changes disrupt development workflows or repository state. Where Gitea Actions is enabled, the unauthorized push may additionally trigger private workflows on push events, expanding the operational impact and potentially causing unintended execution within private CI/CD pipelines. Reported scoring indicates high integrity and availability impact, with no confirmed direct confidentiality impact from the vulnerability itself.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrading is not possible, restrict or disable use of public-only tokens with repository write scope, revoke or rotate existing tokens that match this risk profile, and limit who can invoke pull request update functionality. Reduce or eliminate public-to-private pull request relationships where feasible, particularly where the token owner has write access to the private head branch. Monitor private repositories and Gitea Actions logs for unexpected push-triggered workflow runs and anomalous pull request update activity until the fixed release is deployed.

Remediation

Patch, then assume compromise.

Upgrade Gitea to version 1.27.0 or later, which contains the fix for CVE-2026-58443. Review and reduce exposure from public-only tokens that also possess repository write permissions, especially where those tokens belong to users with write access to private repositories involved in cross-repository pull request relationships. Audit existing public-to-private pull request relationships and inspect recent repository and Actions activity for unexpected server-side updates or workflow executions associated with pull request update operations.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cyber security newsNews

Jul 21, 2026

Critical Gitea Vulnerability Enables Private Repository Writes and Actions Workflow Triggers

A critical incorrect authorization vulnerability in Gitea that allows a public-only repository access token with write scope to indirectly write to private pull request head branches via the pull request update API, potentially triggering private Actions workflows.

security online infoNews

Jul 20, 2026

Gitea CVE-2026-58443 (CVSS 9.6): PoC Exploit Published

A critical access control vulnerability in Gitea that allows a public-only token to push commits into a private repository under certain pull request and permission conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-58443

NVD

nvd.nist.gov/vuln/detail/CVE-2026-58443

MITRE CWE · CWE-863

cwe.mitre.org

Authorization bypass in Gitea pull request update API

IdentifiersCVE-2026-58443CWE-863