CVE-2026-58443

Public-only repository tokens can update private PR head branches...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

CVE-2026-58443

CVE-2026-58443 concerns Gitea. Public-only write tokens can influence a private PR head branch via a public route, because update operations check the head repo’s normal RBAC permissions rather than validating the API token’s scope. The flow allows a POST to the update endpoint for a PR, which tr...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

CVE-2026-58443

creationtimestamp| type| source ---|---|--- 2026-07-20 15:02:39+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mr3ktbnp5p2w 2026-07-21 08:44:34+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mr5g64l3e72v 2026-07-21 08:54:05+00:00| seen|...