VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Aug 13, 2026· Updated Aug 26, 2026

CVE-2026-58443

CVE-2026-58443

Description

Public-only repository tokens can update private PR head branches

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
code.gitea.io/giteaGo
< 1.27.01.27.0

Affected products

2

Patches

Vulnerability mechanics

References

4

News mentions

2