CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed
Do Son 
TL;DR
A critical Gitea vulnerability, CVE-2026-58443 (CVSS 9.6), lets a public-only token push commits into a private repository. Maintainers fixed it in v1.27.0. The security advisory publishes both the full technical breakdown and working proof-of-concept code, though no in-the-wild exploitation has been confirmed.
Why It Matters
Gitea runs self-hosted Git services for teams that want their code off public platforms. The public-only token scope exists precisely to keep automation away from private code. This Gitea vulnerability breaks that promise. Since the advisory ships a complete PoC test, the research effort attackers usually need has already been done.
How the Attack Works
Gitea checks the public-only restriction against the route repository. On a pull request update endpoint, that route repository is the public base. The check therefore passes.
Authorization for the head repository then falls to ordinary user permissions. Gitea never re-applies the token’s public-only limit to that private head. As a result, the server pushes public base commits into the private branch, even though the same token gets rejected for a direct private write.
The side effects go further. When Actions runs on the private head repository, the push triggers its matching workflow. Researchers confirmed that a run and job get queued from the attack-triggered push.
Affected Versions
All Gitea releases up to and including v1.26.4 carry the flaw. Exploitation requires a valid public-only token whose owner already holds write access to the private head branch. A public base repository and an open pull request relationship are also needed.
Patch and Mitigation Steps
Upgrade to Gitea v1.27.0 without delay. Until then, audit tokens carrying the public-only and write:repository scopes together. Revoking or rotating them closes the path. Reviewing recent Actions runs on private repositories can also surface unexpected pushes. The maintainers documented the full analysis in the Gitea security advisory.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
