{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"code.gitea.io/gitea","cve_ids":["CVE-2026-58439"],"ecosystem":"Go","epss":0.00525,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w5pg-649r-p6gg","id":"tcs_01M5KGRPN56BZY28P6ER3DAK1Y","modified_at":"2026-07-27T17:00:26.018061941Z","published_at":"2026-07-27T15:32:45Z","references":["https://osv.dev/vulnerability/GO-2026-6080","https://github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg","https://github.com/go-gitea/gitea/commit/74ad781db9c37134ee9280c69a6b1de53801503e","https://github.com/go-gitea/gitea/commit/8401fe7c544abff1ecc49d7f3166fd4ee0c174ef","https://github.com/go-gitea/gitea/pull/38319","https://github.com/go-gitea/gitea/pull/38402","https://github.com/go-gitea/gitea/releases/tag/v1.27.0"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GO-2026-6080","url":"https://osv.dev/vulnerability/GO-2026-6080"},{"source":"nvd","source_id":"CVE-2026-58439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58439"}],"summary":"Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea"}