CVE-2026-58439

A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...

CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439

Gitea (go-gitea/gitea) is vulnerable to a branch protection bypass in versions before v1.27.0 . The root cause is that PR retargeting preserves a stale official approval flag, allowing unauthorized actions. Remediation requires upgrading to version v1.27.0 . While the SSSC metrics indicate a proo...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

EUVD-2026-58166

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

SUSE CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...