Attack Chain

1. An attacker, with write access to a Gitea repository but not in the protected branch's approval whitelist, creates a temporary unprotected branch from the main branch using the Gitea API.
2. The attacker pushes a malicious commit to a feature branch derived from the main branch.
3. The attacker creates a new pull request (PR) targeting the unprotected temporary branch (tmp-unprotected) with their malicious feature branch using the Gitea API.
4. An accomplice (any non-admin, non-whitelisted user) approves this PR, which Gitea records as official: true because the target branch is unprotected.
5. The attacker then retargets the PR to the protected main branch (master in the example) by sending a PATCH request to the PR endpoint via the Gitea API.
6. Gitea's backend fails to re-evaluate or dismiss the existing reviews, preserving the stale official: true flag from the previous approval.
7. The attacker initiates a merge of the PR into the protected main branch by sending a POST request to the PR merge endpoint. The merge succeeds because the preserved official: true approval satisfies the protected branch's requirements, allowing unauthorized code changes.

Impact

Successful exploitation of CVE-2026-58439 leads to a complete bypass of Gitea's branch protection mechanisms. This allows any user with write access to a repository to merge arbitrary code into protected branches, even if they are not authorized by the designated approval whitelist. This constitutes a significant privilege escalation, as it nullifies admin-configured security controls and enables unauthorized code injection into critical production or development branches. The direct consequence is the introduction of malicious or unapproved code, potentially leading to supply chain attacks, system compromise, or data breaches within the affected environment.

Recommendation

• Upgrade Gitea immediately to version 1.27.0 or later to patch CVE-2026-58439.
• Deploy the Sigma rule "Detects CVE-2026-58439 Exploitation Attempt - Gitea Pull Request Retargeting" to your SIEM to alert on attempts to retarget pull requests via the API.
• Review Gitea webserver logs for PATCH requests to /api/v1/repos/*/pulls/* followed by POST requests to /api/v1/repos/*/pulls/*/merge from users not typically associated with such administrative actions, especially for protected branches.