CVE-2026-58424 affects Gitea Open Source Git Server and involves a bypass of the permanent fork pull request workflow approval gate, categorized under CWE-285 (Improper Authorization), CWE-732 (Incorrect Permission Assignment for Critical Resource), and CWE-863 (Incorrect Authorization). The vulnerability allows an attacker with limited privileges to circumvent approval requirements for pull requests in forked repositories, potentially leading to unauthorized code changes. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope change with partial confidentiality loss, high integrity loss, and high availability loss. The affected version is listed as "=0", which likely indicates an unspecified or placeholder version. No patch or remediation level is currently available from the vendor. The vulnerability is published and assigned a CVE ID but lacks further vendor advisory details or fixes.

The vulnerability allows an attacker with limited privileges to bypass the pull request approval gate in permanent fork workflows, potentially leading to unauthorized code modifications. This can compromise the integrity and availability of the affected Git repositories and may also result in partial confidentiality loss. The CVSS score of 8.9 reflects a high impact on the system's security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Gitea's official channels for updates. Until a patch is available, consider restricting access to trusted users and reviewing pull request workflows to detect suspicious activity.