https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:21:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352914 EUVD-2026-352914 https://cve.radiocsirt.org/vuln/euvd-2026-352914 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58443 <p>Public-only repository tokens can update private PR head branches</p> <p>Public-only repository tokens can update private PR head branches</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58443 https://cve.radiocsirt.org/vuln/ghsa-xxjv-752h-3vp2 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.</p> <p>The vulnerable endpoint is:</p> <p>```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ```</p> <p>Gitea checks the token&#39;s public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token&#39;s public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.</p> <p>As a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.</p> <p>### Details The pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.</p> <p>```go // routers/api/v1/api.go:1358-1394 m.Group(&#34;/pulls&#34;, func() { m.Combo(&#34;&#34;).Get(repo.ListPullRequests). Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest) m.Get(&#34;/pinned&#34;, repo.ListPinnedPullRequests) m.Post(&#34;/comments/{id}/resolve&#34;, reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment) m.Post(&#34;/comments/{id}/unresolve&#34;, reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment) m.Group(&#34;/{in…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route.</p> <p>The vulnerable endpoint is:</p> <p>```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ```</p> <p>Gitea checks the token&#39;s public-only restriction against the route repository, which is the public base repository. `UpdatePullRequest()` then authorizes the pull request head repository with ordinary user RBAC and calls the pull update service. If the head repository is private, the active token&#39;s public-only restriction is not re-applied to that private repository before Gitea pushes changes into it.</p> <p>As a result, the same token that cannot directly write to the private repository can still cause Gitea to push public base commits into the private head branch.</p> <p>### Details The pull request API routes are attached under a repository route group. The public-only check applies to `ctx.Repo.Repository`, the route/base repository.</p> <p>```go // routers/api/v1/api.go:1358-1394 m.Group(&#34;/pulls&#34;, func() { m.Combo(&#34;&#34;).Get(repo.ListPullRequests). Post(reqToken(), mustNotBeArchived, bind(api.CreatePullRequestOption{}), repo.CreatePullRequest) m.Get(&#34;/pinned&#34;, repo.ListPinnedPullRequests) m.Post(&#34;/comments/{id}/resolve&#34;, reqToken(), mustNotBeArchived, repo.ResolvePullReviewComment) m.Post(&#34;/comments/{id}/unresolve&#34;, reqToken(), mustNotBeArchived, repo.UnresolvePullReviewComment) m.Group(&#34;/{in…</p> https://cve.radiocsirt.org/vuln/ghsa-xxjv-752h-3vp2 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304