CVE-2026-58439

21th percentile - higher than 21% of all known CVEs

Branch protection can be bypassed via PR retargeting, preserving a stale `official` approval flag. This allows changes to be pushed to protected branches without the required approval.

Attackers can bypass quality control mechanisms and introduce unauthorized changes to critical branches, potentially leading to code integrity and CI/CD process compromise.

Update Gitea to a patched version and consider additional safeguards such as requiring re-approval after PR retargeting. Monitor PR changes for suspicious retargeting.