The vulnerability in Gitea arises from improper enforcement of the 'public-only' token restriction in the pull request update API endpoint POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update. While the token is validated as public-only against the public base repository route, the subsequent authorization for updating the pull request head branch uses normal user RBAC on the head repository without re-checking the public-only restriction. If the head repository is private, this allows a public-only token to push commits into the private head branch, violating access controls. The issue stems from the route-level public-only check being applied only to the base repository and not to the private head repository during the update operation.

An attacker or user possessing a public-only, write:repository token can indirectly modify private repository branches by updating pull request head branches. This bypasses the intended access control restrictions, potentially leading to unauthorized code changes in private repositories. The vulnerability does not disclose data but allows integrity violations by pushing commits into private branches without direct write access. This can compromise the integrity of private codebases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using public-only tokens with write permissions on repositories involved in pull requests that include private head branches. Monitor vendor communications for patches addressing this issue and apply them promptly once released.