https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 05:21:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-58443 <p>Public-only repository tokens can update private PR head branches</p> <p>Public-only repository tokens can update private PR head branches</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-58443 https://vulnerability.circl.lu/vuln/ghsa-xxjv-752h-3vp2 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.</p> <p>The vulnerable endpoint is:</p> <p>```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ```</p> <p>Gitea checks the token&#39;s public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token&#39;s public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.</p> <p>As a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.</p> <p>### Details The pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.</p> <p>```go // routers/api/v1/api.go:1358-1394 m.Group(&#34;/pulls&#34;, func() { m.Combo(&#34;&#34;).Get(repo.ListPullRequests). Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest) m.Get(&#34;/pinned&#34;, repo.ListPinnedPullRequests) m.Post(&#34;/comments/{id}/resolve&#34;, reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment) m.Post(&#34;/comments/{id}/unresolve&#34;, reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment) m.Group(&#34;/{in…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.</p> <p>The vulnerable endpoint is:</p> <p>```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ```</p> <p>Gitea checks the token&#39;s public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token&#39;s public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.</p> <p>As a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.</p> <p>### Details The pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.</p> <p>```go // routers/api/v1/api.go:1358-1394 m.Group(&#34;/pulls&#34;, func() { m.Combo(&#34;&#34;).Get(repo.ListPullRequests). Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest) m.Get(&#34;/pinned&#34;, repo.ListPinnedPullRequests) m.Post(&#34;/comments/{id}/resolve&#34;, reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment) m.Post(&#34;/comments/{id}/unresolve&#34;, reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment) m.Group(&#34;/{in…</p> https://vulnerability.circl.lu/vuln/ghsa-xxjv-752h-3vp2