CVE-2026-58439
published 2026-08-13CVE-2026-58439: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
PriorityP345high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
0.28%
21.1th percentile
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| go-gitea | gitea | >= 0 < 1.27.0 | 1.27.0 |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
ghsa·2026-07-21
CVE-2026-58439 [HIGH] CWE-863 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
## Summary
Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an `official: true` approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., `master`). The approval, which would have been `official: false` if submitted against the protected branch, is preserved and satisfies the protected branch's required approvals, allowing the attacker to merge without legitimate maintainer approval.
- Confirmed on Gitea **1.25.4** (`1.25.4+41-g96515c0f20`)
## Vulnerability Details
### Root Cause
When a review is submitted on a pull request, Git
Red Hat
code.gitea.io/gitea: Gitea: Branch protection bypass via stale approval flag in PR retargeting
vendor_redhat·2026-08-13·CVSS 8.1
CVE-2026-58439 [HIGH] CWE-472 code.gitea.io/gitea: Gitea: Branch protection bypass via stale approval flag in PR retargeting
code.gitea.io/gitea: Gitea: Branch protection bypass via stale approval flag in PR retargeting
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request (PR) that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity.
Statement: This is an Important flaw in Gitea that allows an attacker to bypass branch protection by manipulating pull requests with stale approval flags, potentially leading to unauthorized code merges and compromising code integrity. This is considered Important due to the potential for unauthorized code execution within a controlled envi
No detection rules found.
No public exploits indexed.
2026-08-13
Published