CVE-2026-58439

A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...

CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439

CVE-2026-58439 describes a branch protection bypass in go-gitea/gitea caused by PR retargeting that preserves a stale official approval flag. The vulnerability enables bypass of branch protection checks, with impact described as high (I) and high (A) in the CVSS metrics, and exploitation noted as...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

GO-2026-6080 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag in go-gitea/gitea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GHSA-W5PG-649R-P6GG Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...

CVE-2026-16089

The CVE-2026-16089 entry describes a vulnerability in Red Hat Build of Keycloak’s keycloak-services, where OAuth 2.0 authorization codes are not properly bound to the client that requested them. If an attacker can intercept an authorization code, they can modify it to be redeemed by their own cli...

CVE-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

EUVD-2026-42250

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable appversions.r2path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2path to point to victim objects, soft-delete the attacker-controlled version, and trigger the...

CVE-2026-56250

Capgo before 12.128.2 is affected. The issue enables upload-scoped API keys to modify the mutable app_versions.r2_path via PostgREST, allowing retargeting of to arbitrary R2 bundle objects. An attacker can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and ...

PT-2026-56429

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app versions.r2 path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2 path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on...

CVE-2026-5135

CVE-2026-5135 concerns Foreman and describes a broken access control vulnerability where an authenticated user with host-edit permissions can retarget an existing lookup value override to a different host by modifying the match field via nested host attributes, effectively bypassing authorisation...

CVE-2026-32043 OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass comma...

CVE-2026-32043

OpenClaw has a TOCTOU vulnerability affecting versions before 2026.2.25 in the approval-bound system.run execution path. The cwd is validated at approval but resolved at execution time, allowing an attacker to retarget a symlinked cwd between approval and execution and bypass command restrictions...

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

This report shows a scope-widening issue in the rotate re-encrypt flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can...

GHSA-465P-V42X-3FMJ Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

This report shows a scope-widening issue in the rotate re-encrypt flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can...

CVE-2026-22728 sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...