← News
/DISPATCH · 2026-08-07

CVE-2026-58443: Gitea public-only tokens can write private repos and trigger Actions, CVSS 9.6 PoC public

Self-hosted Gitea has a critical token-scope bypass, CVE-2026-58443 (CVSS 9.6). A public-only token can push public commits into a private head repo via the PR update endpoint and trigger private Actions. Fixed in v1.27.0. Full PoC is public.

CVE-2026-58443 (GHSA-xxjv-752h-3vp2) is a critical authz bypass in self-hosted Gitea, CVSS 3.1 9.6. A caller holding only a public-only scoped token can push commits from a public base repo into a private head repo via the PR update endpoint, then trigger Actions on that private repo. Token-scope isolation is fully bypassed. Fixed in Gitea v1.27.0. Full PoC is public.

Overview

Gitea is a widely used lightweight self-hosted Git service and a common internal code host / CI trigger. The bug is in `POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update`. Gitea's public-only check applies only to the route/base repo. `UpdatePullRequest()` then runs a normal `IsUserAllowedToUpdate()` RBAC check on the private head repo and does not re-apply token-scope limits. If Actions is enabled on the head repo, the injected push is treated as a legitimate push, creating `ActionRun` and `ActionRunJob`. Public-scope credentials then drive private CI/CD.

Technical Details

Official snippet (`routers/api/v1/api.go:1358-1394`) shows PR routes nested under `checkTokenPublicOnly()`, but the inner `/update` endpoint does not repeat that check on the head repo:

`m.Group("/pulls", func() {
    ...
    m.Group("/{index}", func() {
        ...
        m.Post("/update", reqToken(), repo.UpdatePullRequest)
        ...
    })
}, mustAllowPulls, reqRepoReader(unit.TypeCode), ...
}, repoAssignment(), checkTokenPublicOnly())`

Prerequisites:

CWE-863 Incorrect Authorization. Impacts Integrity and Availability. Scope is Changed (C). PoC check: direct writes to the private repo return 404; the PR update endpoint merges public commits into the private branch and fires Actions.

Impact

All Gitea v1.26.4 and earlier are affected. CVSS vector `AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H`. On self-hosted installs, an attacker can inject code into private repos and private pipelines without direct write on the private repo. EPSS is high. Researchers published a full PoC. No confirmed in-the-wild use. With the PoC public, and several Gitea scope-boundary failures in the last six months (reverse-proxy auth bypass, webhook SSRF), mass-exploit cost is low.

Remediation

References