https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 00:27:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-58439 <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag</p> <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag</p> https://cve.radiocsirt.org/vuln/cve-2026-58439 https://cve.radiocsirt.org/vuln/ghsa-w5pg-649r-p6gg <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR&#39;s target branch is changed. An attacker with write access to a repository can obtain an `official: true` approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., `master`). The approval, which would have been `official: false` if submitted against the protected branch, is preserved and satisfies the protected branch&#39;s required approvals, allowing the attacker to merge without legitimate maintainer approval.</p> <p>- Confirmed on Gitea **1.25.4** (`1.25.4+41-g96515c0f20`)</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>When a review is submitted on a pull request, Gitea computes the `official` flag by checking whether the reviewer is in the **target branch&#39;s** approval whitelist (`IsUserOfficialReviewer` in `models/git/protected_branch.go`). This flag is stored in the database as a boolean on the review record.</p> <p>When a PR&#39;s target branch is subsequently changed via `ChangeTargetBranch` (`services/pull/pull.go:218`), the function: - Updates `pr.BaseBranch` - Recalculates merge feasibility and divergence - Deletes old push comments - Creates a &#34;change target branch&#34; comment</p> <p>But it does **not**: - Re-evaluate `official` on existing reviews - Dismiss existing approvals - Check whether reviewers are in the new target branch&#39;s approval whitelist</p> <p>At merge time, `GetGrantedApprovalsCount` (`models/issues/pull.go:766`) counts reviews where `official =…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR&#39;s target branch is changed. An attacker with write access to a repository can obtain an `official: true` approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch (e.g., `master`). The approval, which would have been `official: false` if submitted against the protected branch, is preserved and satisfies the protected branch&#39;s required approvals, allowing the attacker to merge without legitimate maintainer approval.</p> <p>- Confirmed on Gitea **1.25.4** (`1.25.4+41-g96515c0f20`)</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>When a review is submitted on a pull request, Gitea computes the `official` flag by checking whether the reviewer is in the **target branch&#39;s** approval whitelist (`IsUserOfficialReviewer` in `models/git/protected_branch.go`). This flag is stored in the database as a boolean on the review record.</p> <p>When a PR&#39;s target branch is subsequently changed via `ChangeTargetBranch` (`services/pull/pull.go:218`), the function: - Updates `pr.BaseBranch` - Recalculates merge feasibility and divergence - Deletes old push comments - Creates a &#34;change target branch&#34; comment</p> <p>But it does **not**: - Re-evaluate `official` on existing reviews - Dismiss existing approvals - Check whether reviewers are in the new target branch&#39;s approval whitelist</p> <p>At merge time, `GetGrantedApprovalsCount` (`models/issues/pull.go:766`) counts reviews where `official =…</p> https://cve.radiocsirt.org/vuln/ghsa-w5pg-649r-p6gg