Threat reportVulnerabilityTL-2026-1587
Gitea CVE-2026-58443: Authorization Bypass in Pull Request Update API Enables Private Repo Access
Gitea CVE-2026-58443 (TL-2026-1587), also tracked as GHSA-xxjv-752h-3vp2, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-07-21. It has no confirmed attribution, affects Gitea Gitea (self-hosted Git service), references 3 CVEs (CVE-2026-58443, CVE-2026-58424, CVE-2026-58426), maps to 15 MITRE ATT&CK techniques (T1069, T1072, T1078), and is covered by 9 detection rules and 29 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1587
- Threat ID
- TL-2026-1587
- Also known as
- GHSA-xxjv-752h-3vp2
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government administration, finance, health, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Gitea CVE-2026-58443
Malware and tooling: CVE-2026-58424, CVE-2026-58426, CVE-2026-58433, CVE-2026-58435, CVE-2026-58436, CVE-2026-58443, CVE-2026-59765, GHSA-xxjv-752h-3vp2, Gitea, Gitea Actions, Gitea Actions Artifacts V4
How Gitea CVE-2026-58443 works
A public-only-scoped Gitea API token can be used against the pull request update endpoint to push commits from a public base repository into a private pull request's head branch, bypassing Gitea's public/private token confinement. A demonstrated PoC used an injected commit to trigger a private Gitea Actions workflow (ActionRun), proving code-execution-adjacent impact from what is nominally an access-control bug. Fixed in Gitea v1.27.0 (PR #38406); affects all versions up to v1.26.4.
CVE-2026-58443 (GHSA-xxjv-752h-3vp2) is an Incorrect Authorization vulnerability (CWE-863) in Gitea's pull request update API, `POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update`. Gitea supports 'public-only' access tokens that are supposed to be confined to interacting solely with public repositories and resources. The update endpoint validates the requesting token's public-only restriction against the *public base repository* named in the API route, but fails to re-apply that same restriction when the operation subsequently touches the pull request's *head repository* — which can be a private repository, provided the caller (a human account, not the token itself) already holds normal write permission there through an existing public-base/private-head PR relationship.
Because the authorization check only inspects the base repository's visibility, an attacker holding a public-only token can issue an authenticated API call that pushes new commits onto the private head branch of the pull request, even though the token was never meant to be able to touch private-repository content at all. This is a token-scope confused-deputy flaw: the API borrows the human account's broader write permission on the private repo while the request itself is authenticated with a token that should never have been able to reach it. As one technical writeup summarized it: 'A token that fails when attempting a direct write to a private repository can still modify a private branch through the pull request update function.'
The exploit chain requires: (1) a valid public-only access token with `write:repository` scope, (2) a user account that already holds normal write permission on the private PR head branch, (3) an existing public base repository, and (4) a pull-request relationship permitting base-to-head updates. The attacker stages content in the public base repository, invokes the vulnerable update endpoint targeting the private head branch, and Gitea server-side merges/rebases the public commits into the private branch. If Gitea Actions is enabled with push-triggered workflows on that private repository, the server-side push causes those workflows to execute automatically within the private repository's context — with access to any secrets, deploy credentials, and build artifacts scoped to that workflow. Researchers demonstrated exactly this: an injected commit landing on the private PR head branch via the bypass caused Gitea to start a matching private-repository ActionRun and associated job.
The flaw was reported by security researcher ohxorud-dev and patched by Gitea maintainer bircni via pull request #38406 (co-authored/reviewed by TheFox0x7, techknowlogick, Lunny Xiao, wxiaoguang, and Zettat123, with an automated Copilot AI review covering 84 files), merged 2026-07-12 and released as part of Gitea v1.27.0 (milestone 28.0.0). PR #38406 was a large, coordinated security-hardening PR — 36 commits across 84 files — bundling 46 distinct CVE fixes across four categories: (a) SSRF protections for migration asset/PR-patch fetches, OAuth2 avatar fetches, OpenID discovery, pull-mirror URL re-validation, and outbound proxy path validation (introducing a new `[security].ALLOWED_HOST_LIST` setting that deprecates the old `[webhook].ALLOWED_HOST_LIST`); (b) access-token scope enforcement fixes preventing scope escalation at token creation and confining public-only tokens across feeds, packages, Actions listings, and star/watch lists (CVE-2026-58443 falls in this category); (c) access-control/disclosure fixes blocking go-get default-branch leaks, webhook authorization-header exposure via API, stale watches on private-repo visibility transitions, and cross-repo label/attachment scoping; and (d) DoS mitigations (npm dist-tag bounds, Debian control-file decompression limits, Arch package file-list caps, SSH public-key length validation). Named sibling CVEs from the same v1.27.0 remediation batch include CVE-2026-58433 (team-repository linking endpoint circumvented org settings), CVE-2026-58435 (LFS deploy-key privilege escalation), CVE-2026-58436 (DoS via Accept-Language header parsing), and CVE-2026-59765 (SSRF in migration asset downloads bypassing host validation).
CVE-2026-58443 also sits in a broader 2026 pattern of Gitea authorization/access-control CVEs. An earlier Gitea bulletin (SB2026062240, published 2026-06-22, covering Gitea 0.9.99-1.26.2) catalogued 8 related access-control flaws, several also CWE-863/CWE-284 'incorrect authorization' class bugs (e.g. CVE-2026-27775, 'gain full repository write access'; CVE-2026-20896, CVSS 9.1, 'impersonate arbitrary users' on Docker deployments). Separately, CVE-2026-58424 (CVSS 8.9, CWE-285/CWE-732/CWE-863, fixed in 1.26.3/1.26.4, published 2026-07-03) let attackers bypass permanent-fork pull-request workflow approval gates, and CVE-2026-58426 (CVSS 9.6, CWE-347 HMAC ambiguity, fixed in 1.26.2) allowed cross-repository Gitea Actions Artifacts V4 signed-URL reads and cross-task upload-state writes — both PR-workflow/CI-adjacent authorization flaws in the same subsystem family as CVE-2026-58443, underscoring a recurring class of bugs in Gitea's pull-request/Actions trust boundary. Cyber Security News published a public technical writeup of CVE-2026-58443 specifically on 2026-07-21. As of this writing the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; exploitability is assessed as proof-of-concept-public rather than confirmed active exploitation in the wild.
MITRE ATT&CK techniques used in TL-2026-1587
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery
Lateral Movement
T1072 Software Deployment Tools
Privilege Escalation
T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism
Persistence
Initial Access
T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
initial-access
T1195.002 Compromise Software Supply Chain
Collection
T1213 Data from Information Repositories
lateral-movement
T1550.001 Application Access Token
Impact
T1565.001 Stored Data Manipulation
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
Affected products and versions in Gitea CVE-2026-58443
Remediation for Gitea CVE-2026-58443
Patches
- Gitea v1.27.0 — fix landed via PR #38406, backported for the 1.27 release line
- Gitea v1.26.3 / v1.26.4 — earlier fixes for related PR-workflow/artifact authorization bugs CVE-2026-58424 and CVE-2026-58426
Immediate actions
- Upgrade all Gitea instances to v1.27.0 or later, which contains the fix from PR #38406
- Audit issued public-only access tokens and rotate any tokens with write:repository scope used against repositories that participate in cross-visibility (public base / private head) pull requests
- Review Gitea Actions run history for private repositories for unexpected ActionRun entries correlated with pull-request-update API calls from public-only tokens
- Restrict or temporarily disable Gitea Actions on privately-hosted repositories that receive pull requests from public base repositories until patched
- Check for the sibling CVEs bundled in the same v1.27.0 release (CVE-2026-58433, -58435, -58436, -59765) and the earlier CVE-2026-58424 / CVE-2026-58426 workflow-and-artifact bypasses when planning the upgrade
Workarounds
- Where upgrading is not immediately possible, revoke or avoid using public-only scoped tokens entirely on instances hosting private repositories that share pull-request relationships with public repositories
Longer-term hardening
- Enforce least-privilege token scoping practices; avoid issuing public-only tokens to automation that also has legitimate write access to private repositories
- Add monitoring/alerting on API calls to the pull request update endpoint (`/api/v1/repos/{owner}/{repo}/pulls/{index}/update`) that cross a public-base/private-head repository boundary
- Treat Gitea Actions workflow triggers on any repository reachable via cross-visibility pull requests as a supply-chain attack surface requiring the same secrets hygiene as public CI/CD
- Subscribe to Gitea's official security advisory feed (about.gitea.com/security) to track future CVEs in the same 2026 remediation series
- Migrate webhook host-allowlisting from the deprecated `[webhook].ALLOWED_HOST_LIST` to the new unified `[security].ALLOWED_HOST_LIST` introduced alongside this patch
CVEs associated with Gitea CVE-2026-58443
Weaknesses (CWE) in Gitea CVE-2026-58443
Timeline of Gitea CVE-2026-58443
- Gitea released v1.26.3 and v1.26.4, fixing related pull-request/Actions authorization bugs CVE-2026-58424 (fork PR approval-gate bypass) and CVE-2026-58426 (Actions Artifacts V4 signed-URL/HMAC flaw) — the same subsystem family as CVE-2026-58443.
- Security bulletin SB2026062240 published, cataloguing 8 access-control vulnerabilities (several CWE-863/CWE-284 incorrect-authorization class) affecting Gitea 0.9.99 through 1.26.2, establishing the broader pattern of authorization flaws this CVE belongs to.
- CVE-2026-58424 and CVE-2026-58426 (fork PR-workflow bypass and Actions Artifacts V4 cross-repository read/write flaw) publicly published.
- Threat-intelligence research (mallory.ai) first documented the CVE-2026-58424/CVE-2026-58426 Gitea PR-workflow and artifact-access vulnerabilities.
- GitHub Security Advisory GHSA-xxjv-752h-3vp2 published, publicly crediting the vulnerability report to security researcher ohxorud-dev and the patch to Gitea maintainer bircni.
- Gitea v1.27.0 released (milestone 28.0.0), bundling the CVE-2026-58443 fix alongside sibling CVEs CVE-2026-58433, CVE-2026-58435, CVE-2026-58436, and CVE-2026-59765, plus SSRF protections and access-token scope-escalation fixes; introduces the new [security].ALLOWED_HOST_LIST setting.
- Fix for CVE-2026-58443 merged into go-gitea/gitea via PR #38406 (36 commits, 84 files, bundling 46 CVE fixes total), authored by maintainer bircni following the report from researcher ohxorud-dev, with co-authorship/review from TheFox0x7, techknowlogick, Lunny Xiao, wxiaoguang, and Zettat123.
- TL-Intel-Harness flagged CVE-2026-58443 for tracking based on its CVSS 9.6 network-exploitable rating and the public PoC demonstrating unauthorized private-repository code execution via CI/CD trigger.
- Cyber Security News published a public technical writeup of CVE-2026-58443, detailing the authorization bypass mechanism and the demonstrated PoC that triggered a private Gitea Actions workflow via an injected commit.
Sources cited for Gitea CVE-2026-58443
- Gitea Vulnerability Article - CVE-2026-58443
- Gitea 1.27.0 is released
- fix: Various security fixes (PR #38406)
- go-gitea/gitea Security Advisories
- SB2026062240 - Multiple vulnerabilities in Gitea
- High-Severity Gitea Flaws Enable Workflow Bypass and Artifact Access
- Gitea Official Security Page
- GHSA-xxjv-752h-3vp2: Public-only repository tokens could update private pull-request head branches
Detection coverage for TL-2026-1587
As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1587 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.