Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)

Gitea fails to re-apply a token's public-only restriction when the pull request update endpoint (`POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`) operates on a private head repository. The public-only check is evaluated only against the route's base repository; the head repository authorization falls through to ordinary user RBAC without token scope enforcement. A valid `public-only,write:repository` token can thereby cause Gitea to push public base commits into a private head branch, and when Actions is enabled on the private repository, also trigger private `push` workflow runs. Affected versions: - <= v1.26.4 We recommend updating to: 1.27.0. CVSS 9.6 · our assessment: act_now Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2 Details: https://vuln.today/cve/CVE-2026-58443