Description

Public-only repository tokens can update private PR head branches

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T17:17:28.330Z",
  "pubdate": "2026-08-13T17:17:28.330Z",
  "executiveSummary": "This vulnerability involves an access control flaw where public-only repository tokens possess the capability to update private pull request head branches.\nThe primary impact of this security issue is unauthorized modification of source code and repository state within private pull requests by entities possessing only public-level repository access tokens.\nAffected systems include environments utilizing repository automation and token-based authentication mechanisms that fail to adequately segregate permissions between public and private repository scopes.\nThe risk implications are severe, as an attacker with limited public access can potentially inject malicious code, alter pull request contents, and compromise the integrity of private downstream builds or reviews.\nAttacker capabilities include the manipulation of pull request head branches originating from public forks or contexts into private repositories.\nExploitation requirements include the acquisition or utilization of a public-only repository token and the presence of a cross-boundary pull request interaction between public and private repository scopes.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization enforcement and privilege validation logic within the repository management platform's API boundaries, specifically concerning token permission scopes.\nThe vulnerable component handles git reference updates and pull request head branch mutations, failing to verify whether a token restricted to public repository contexts should hold write or update permissions over branches associated with private pull requests.\nExploitation occurs when an actor leverages a public-only repository token to interact with the API endpoints responsible for modifying pull request head branches.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or obtains a token constrained strictly to public repository operations. Second, the attacker targets a private pull request that accepts contributions or interactions from public contexts. Third, the attacker issues a specially crafted API request using the public token to update the head branch of the private pull request. Fourth, the platform improperly accepts the authorization context of the token, bypassing intended permission boundaries. Finally, the private pull request head branch is successfully modified with attacker-controlled commits or data.\nAuthentication requirements involve the presentation of a valid repository token, though specifically one intended to be restricted to public visibility and access levels.\nPrivilege requirements are nominally low from the perspective of the compromised token, which should theoretically lack write or update access to private repository resources.\nNetwork exposure is inherent to the platform's API endpoints utilized for managing pull requests and git references.\nThe post-exploitation impact includes unauthorized code execution paths, potential supply chain compromise via malicious pull request merges, and exposure of private repository development workflows to unauthorized modifications."
}