{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/branch-protection-bypass/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea (\u003c 1.27.0)"],"_cs_severities":["critical"],"_cs_tags":["branch-protection-bypass","code-repository","privilege-escalation","gitea","persistence","web-application","vulnerability","defense-evasion","network","credential-theft","mitm","certificate-validation-bypass","cve","code-hosting","supply-chain-attack","data-exfiltration"],"_cs_type":"advisory","_cs_vendors":["Gitea"],"content_html":"\u003cp\u003eA critical vulnerability, CVE-2026-58439, affects Gitea versions prior to 1.27.0, enabling attackers with write access to a repository to bypass branch protection rules. The flaw stems from Gitea's failure to re-evaluate the \u003ccode\u003eofficial\u003c/code\u003e flag on existing pull request reviews when a PR's target branch is changed. This allows an attacker to first create a pull request (PR) targeting an unprotected branch, obtain a seemingly legitimate \u0026quot;official: true\u0026quot; approval from any non-whitelisted account, and then retarget the PR to a protected branch (e.g., \u003ccode\u003emaster\u003c/code\u003e). Because the stale \u0026quot;official: true\u0026quot; flag is preserved, it satisfies the protected branch's required approval count, enabling the attacker to merge malicious code without true maintainer oversight. This bypass effectively escalates privileges and undermines secure code collaboration workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, with write access to a Gitea repository but not in the protected branch's approval whitelist, creates a temporary unprotected branch from the main branch using the Gitea API.\u003c/li\u003e\n\u003cli\u003eThe attacker pushes a malicious commit to a feature branch derived from the main branch.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a new pull request (PR) targeting the \u003cem\u003eunprotected\u003c/em\u003e temporary branch (\u003ccode\u003etmp-unprotected\u003c/code\u003e) with their malicious feature branch using the Gitea API.\u003c/li\u003e\n\u003cli\u003eAn accomplice (any non-admin, non-whitelisted user) approves this PR, which Gitea records as \u003ccode\u003eofficial: true\u003c/code\u003e because the target branch is unprotected.\u003c/li\u003e\n\u003cli\u003eThe attacker then retargets the PR to the \u003cem\u003eprotected\u003c/em\u003e main branch (\u003ccode\u003emaster\u003c/code\u003e in the example) by sending a \u003ccode\u003ePATCH\u003c/code\u003e request to the PR endpoint via the Gitea API.\u003c/li\u003e\n\u003cli\u003eGitea's backend fails to re-evaluate or dismiss the existing reviews, preserving the stale \u003ccode\u003eofficial: true\u003c/code\u003e flag from the previous approval.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a merge of the PR into the protected main branch by sending a \u003ccode\u003ePOST\u003c/code\u003e request to the PR merge endpoint. The merge succeeds because the preserved \u003ccode\u003eofficial: true\u003c/code\u003e approval satisfies the protected branch's requirements, allowing unauthorized code changes.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-58439 leads to a complete bypass of Gitea's branch protection mechanisms. This allows any user with write access to a repository to merge arbitrary code into protected branches, even if they are not authorized by the designated approval whitelist. This constitutes a significant privilege escalation, as it nullifies admin-configured security controls and enables unauthorized code injection into critical production or development branches. The direct consequence is the introduction of malicious or unapproved code, potentially leading to supply chain attacks, system compromise, or data breaches within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eUpgrade Gitea immediately\u003c/strong\u003e to version 1.27.0 or later to patch CVE-2026-58439.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule\u003c/strong\u003e \u0026quot;Detects CVE-2026-58439 Exploitation Attempt - Gitea Pull Request Retargeting\u0026quot; to your SIEM to alert on attempts to retarget pull requests via the API.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Gitea webserver logs\u003c/strong\u003e for \u003ccode\u003ePATCH\u003c/code\u003e requests to \u003ccode\u003e/api/v1/repos/*/pulls/*\u003c/code\u003e followed by \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/v1/repos/*/pulls/*/merge\u003c/code\u003e from users not typically associated with such administrative actions, especially for protected branches.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T21:07:18Z","date_published":"2026-07-21T20:15:57Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-branch-protection-bypass/","summary":"An attacker with write access to a Gitea repository can bypass branch protection rules by exploiting a logic flaw, obtaining an 'official' approval on a pull request (PR) targeting an unprotected branch, then retargeting the PR to a protected branch, preserving the stale approval and leading to unauthorized code merges and privilege escalation.","title":"Gitea Branch Protection Bypass via Pull Request Retargeting","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-branch-protection-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Branch-Protection-Bypass","version":"https://jsonfeed.org/version/1.1"}