CVE-2026-79960

Executive Summary

CVE-2026-79960 is an authorization bypass (incorrect authorization, CWE-863) in Gitea's push hook pipeline. When a Git push is authenticated with a deploy key, Gitea misattributes the pushed action to the repository owner instead of to the deploy key, causing all subsequent permission checks to evaluate against the owner's privileges. As a result, an actor holding only a writable deploy key — a credential intended to be narrowly scoped — can perform owner-level repository actions such as creating protected tags outside the tag allow list, changing repository visibility (including making a private repository public) via push options, and creating pull requests through the AGit flow attributed to the owner. The vulnerability is currently UNPATCHED (patch confidence 0/4), has no assigned CVSS score, no EPSS score, no CISA KEV listing, and no public PoC or Nuclei template.

Technical Analysis

The defect is an identity/attribution error in Gitea's push authentication and hook permission evaluation path. Git deploy keys are repository-scoped SSH keys typically used for automated CI/CD or mirroring workloads. They are intended to carry a strictly limited privilege set — for example, the ability to push to a repository without receiving the full permissions of a human collaborator or the repository owner.

According to the NVD description, when a push is authenticated with a deploy key, "Gitea recorded the repository owner as the pusher." The push hook pipeline then performs permission checks against this recorded pusher identity. Because the recorded identity is the repository owner, every downstream authorization decision runs against owner-level permissions rather than the constrained deploy-key permission context. This is the core bug: the authenticated principal (the deploy key) and the recorded/effective principal (the repository owner) diverge, so authorization decisions are made on the wrong subject.

The CWE classification is CWE-863 (Incorrect Authorization). The observable consequences described are:

1. A holder of a writable deploy key can create protected tags even though that identity is not on the tag allow list. Protected-tag enforcement in Gitea normally restricts tag creation to a defined allow list; because the check evaluates the owner instead of the deploy key, the allow-list restriction is not enforced against the actual actor.

2. The same holder can change repository visibility through push options — the description explicitly gives the example of changing a private repository to public.

3. Pull requests created through the AGit flow with a deploy key are also attributed to the owner, extending the misattribution beyond direct pushes.

This is a confused-deputy pattern: the deploy-key holder supplies the credential (the deputy), but the privilege that gets exercised belongs to the owner (the principal). The attacker does not need to compromise the owner's account or key; possession of a writable deploy key alone is sufficient to trigger the misattribution.

No public proof-of-concept, exploit code, or Nuclei template is available, and no CVSS vector or score has been assigned by NVD. The CVSS vector shown in the metadata above is an analytical estimate based on the described impact and has not been confirmed by the vendor or NVD. Affected version ranges are not published. No patch has been identified by any tracked source, so the vulnerable code path should be assumed present in deployed versions until a vendor advisory confirms otherwise. Independent code-level verification of the exact function or module responsible cannot be performed from the supplied data.

Exploitation Scenarios

Attack chain inferred from the vulnerability class and the NVD description; no public PoC is available, so this section does not rely on any specific exploit code.

1. Reconnaissance / target identification. The actor must obtain a writable deploy key for the target repository, or already legitimately hold one (for example, a CI/CD integration, a contractor with an automated deploy key, or an attacker who has compromised such a key). Repository identification proceeds normally — locating the Gitea instance and the target repository for which the deploy key is authorized. No exploit of the authentication layer is required.

2. Triggering the flaw. The actor authenticates a push over SSH using the deploy key. Because the push is authenticated with a deploy key, Gitea records the repository owner as the pusher, and the push hook pipeline evaluates permission checks against the owner identity rather than the deploy key. The authorization bypass is therefore triggered simply by performing an authenticated push — no payload-level exploitation of memory corruption, injection, or deserialization is involved.

3. Action execution. With permission checks now resolving to owner-level privileges, the actor leverages normal Git/Gitea features that would otherwise be denied to a deploy key:

   • Creating protected tags despite not being on the tag allow list.
   • Changing repository visibility through push options (for example, converting a private repository to public).
   • Creating pull requests via the AGit flow, which are attributed to the owner.

4. Post-exploitation impact. The visibility change is the highest-immediacy risk: making a private repository public can expose proprietary source code, secrets committed to history, and internal configuration to unauthenticated or anonymous users. Creating protected tags can subvert release-integrity controls by minting tags that bypass the allow list, potentially poisoning downstream packaging, artifact publication, or CI workflows that trust tags. Pull requests attributed to the owner can be used to launder malicious changes as owner-authored and to obscure the true source of a contribution, complicating audit and review. Because the actions are recorded against the owner, post-incident attribution is degraded — repository history and audit logs will point at the owner rather than at the deploy key that actually performed the action.

Impact Assessment

The confidentiality and integrity impact is high and scope is unchanged. The actor needs only a writable deploy key, so the attack is reachable with low privilege relative to the owner (AV:N/AC:L/PR:L/UI:N). The most severe outcomes are exposure of private repository contents via visibility change and integrity compromise of release/protected-tag controls and pull-request provenance.

Blast radius is bounded by the deploy key's repository scope: only repositories for which the actor holds a writable deploy key are directly affected. However, downstream impact can extend beyond the repository itself — public exposure of a repository may leak credentials and internal documentation, and forged protected tags may propagate into packaging pipelines, container registries, and deployment automation that consumes tagged releases. Organizations that rely on protected tags or private repositories as release-integrity guardrails should treat this as a high-priority authorization weakness. CVSS subscores referenced above are analytical estimates; NVD has not assigned a score, and no EPSS value has been published, so no first.org exploitation-probability estimate can be cited.

Detection Guidance

Sigma Rule

title: Gitea Deploy Key Push Executing Owner-Level Repository Operations (CVE-2026-79960)
id: 7f3b1c9e-2a4d-4e8b-9c1f-0d5a6b2e4f10
status: experimental
description: Detects Gitea push events authenticated by a deploy key that result in owner-level actions such as protected tag creation or repository visibility changes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79960
author: threat-intel
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_push:
    action:
      - 'push'
      - 'git.push'
  selection_deploykey:
    actor_type: 'deploy_key'
  selection_sensitive:
    - details:
        contains: 'protected'
    - details:
        contains: 'visibility'
    - details:
        contains: 'private'
    - details:
        contains: 'public'
  condition: selection_push and selection_deploykey and selection_sensitive
falsepositives:
  - Legitimate CI/CD pipelines that push protected tags with owner-configured deploy keys
level: high
tags:
  - attack.t1078
  - cve.2026.79960

YARA Rule

rule CVE_2026_79960_Gitea_Deploykey_Misattribution
{
    meta:
        description = "Flags Gitea source/build artifacts containing deploy key push attribution handling associated with CVE-2026-79960"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79960"
        cve = "CVE-2026-79960"
        author = "threat-intel"
        date = "2026-01-01"

    strings:
        $a = "deploy key" ascii nocase
        $b = "deploy_key" ascii nocase
        $c = "protected tag" ascii nocase
        $d = "push option" ascii nocase
        $e = "AGit" ascii
        $f = "recorded the repository owner" ascii nocase

    condition:
        (uint32(0) == 0x464C457F or uint16(0) == 0x5A4D) and
        filesize < 200MB and
        2 of ($a, $b, $c, $d, $e, $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79960 Gitea Deploy Key Push Option Repository Visibility Change Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/git-receive-pack"; http.header; content:"git-protocol"; pcre:"/(?i)push[-_ ]?option|visibility|private|public/"; reference:cve,2026-79960; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79960; classtype:attempted-admin; sid:202679960; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.action == "ssh_auth" and
      process.name == "sshd" and
      gitea.auth.type == "deploy_key" ]
  [ process where event.category == "web" and
      gitea.action in ("push", "git.push") and
      (gitea.details : "protected" or gitea.details : "visibility" or
       gitea.details : "public" or gitea.details : "private") ]

Splunk SPL Query

index=gitea sourcetype=gitea:audit
| search (action="push" OR action="git.push")
| eval sensitive=if(match(_raw, "(?i)protected|visibility|private|public"), 1, 0)
| eval deploykey=if(match(_raw, "(?i)deploy.?key"), 1, 0)
| where sensitive=1 AND deploykey=1
| table _time, repo, actor, action, details, src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="gitea,cve-2026-79960,">
  <rule id="100960" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">push|git.push</field>
    <regex field="details">(?i)(protected|visibility|private|public)</regex>
    <regex field="actor_type">(?i)deploy.?key</regex>
    <description>CVE-2026-79960: Gitea deploy-key push performed owner-level repository operation (protected tag or visibility change).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_79960,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Audit and minimize writable deploy keys across all Gitea repositories. Remove or downgrade any deploy key that does not strictly require write access; prefer read-only deploy keys for mirroring and read-only CI tasks.
• Rotate deploy keys whose scope cannot be reduced, and avoid sharing a single writable deploy key across multiple repositories or teams.
• Where operationally feasible, disable the affected push behaviors for deploy-key-originated pushes: restrict repository visibility changes to manual owner action, and review protected-tag rules to ensure they cannot be satisfied through deploy-key pushes.
• Monitor audit logs for pushes attributed to the repository owner that originate from deploy-key authentication, and for visibility changes (private → public) and protected-tag creation events.
• Treat any repository that has ever had a writable deploy key as potentially subject to forged tags or improper pull-request attribution, and re-verify release tags and PR provenance.

2. Patch/upgrade steps

• No vendor patch or fixed version has been identified from any tracked source. Monitor the Gitea project's security advisories and release notes for a fix that corrects deploy-key push attribution and restores permission checks against the deploy-key principal.
• Do not assume a version is fixed without explicit vendor confirmation; because the patch confidence is 0/4, no upgrade target can be recommended at this time.

3. Long-term hardening

• Enforce least privilege on all automation credentials, including deploy keys, and prefer scoped tokens or per-repository keys over broadly shared credentials.
• Require protected-tag and repository-visibility changes to be performed by authenticated human users with explicit allow-list membership, and treat deploy-key-originated requests as untrusted for these operations.
• Deploy centralized audit and alerting for owner-attributed actions issued from automated credentials, and periodically reconcile the identity recorded in logs against the credential actually used.
• Continuously track the CVE for a vendor advisory, patch, and any assigned CVSS/EPSS data.

References

• NVD — CVE-2026-79960: https://nvd.nist.gov/vuln/detail/CVE-2026-79960
• CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Gitea project security advisories and release notes (monitor for a fix): https://github.com/go-gitea/gitea/security/advisories
• No public PoC, exploit code, or Nuclei template is available as of this report; CVE-2026-79960 is not listed in CISA KEV, and no known threat actor campaigns or exploit-in-the-wild evidence have been reported.