Branch protection bypass via PR retargeting in Gitea (CVE-2026-58439)

Gitea does not re-evaluate the `official` flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access can obtain an `official: true` approval against an unprotected branch, retarget the PR to a protected branch, and have that stale approval satisfy the protected branch's required approvals count. This allows merging into a protected branch without any whitelisted approver reviewing the changes. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 8.1 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg Details: https://vuln.today/cve/CVE-2026-58439