CVE-2026-58443Critical· 9.6▾ Midnight

code.gitea.io/gitea: Gitea: Unauthorized update of private pull request branches via public-only tokens (CVE-2026-58443)

A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request (PR) branches. This could lead to unauthorized changes in private code, compromising the integri…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score53/ 100 · Moderate

impact 52.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 13, 2026

Updated

Sep 25, 2026

CVSS

9.6

Vendor

Red Hat

Product

OpenShift Pipelines

CWE

CWE-266, CWE-863

Depth score

53 · Moderate

EPSS

0.58% · p47

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 14.

0.2% → 0.6%▲ 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 43 days

Aug 13, 2026Published
Disclosed via CSAF
Aug 14, 2026EPSS first tracked
0.2%
Sep 25, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS peak
0.2% → 0.6%

Red Hat CWE-266 CWE-863 #csaf #vex #red-hat #ghsa #go

Affected

openshift_pipelines

Patched in

code.gitea.io/gitea 1.27.0

Full technical detail▾

Overview

Vendor advisories

Red Hat VEX · Important · affected: OpenShift Pipelines · no fix planned: OpenShift Pipelines · updated 2026-09-25 · vex

code.gitea.io/gitea: Gitea: Unauthorized update of private pull request branches via public-only tokens — rated Important by Red Hat. Released 2026-08-13, updated 2026-09-25.

Affected:

OpenShift Pipelines

No fix planned:

OpenShift Pipelines

Remediation

Will not fix

Workarounds / mitigations:

Update to Gitea 1.27.0 or later. As a workaround, restrict the use of public-only tokens in environments where both public and private repositories with pull request relationships exist, or implement additional access controls at the API gateway level to prevent access to pull request update endpoints.

Package advisory (CVE-2026-58443)

Affected packages:

code.gitea.io/gitea < 1.27.0

Patched in:

code.gitea.io/gitea 1.27.0

Source: https://github.com/advisories/GHSA-xxjv-752h-3vp2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#ghsa#go

← Back to feed