CVE-2026-58443

CriticalCVSS 9.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Public-only repository tokens can update private PR head branches.

An attacker with a limited token can modify pull request branches, potentially leading to unauthorized code changes.

Update Gitea to a patched version and ensure repository tokens have appropriate permissions for branch modifications.

Original NVD description (English source)

Public-only repository tokens can update private PR head branches