Executive brief
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea
Affected products
- Go code.gitea.io/gitea
- Go github.com/go-gitea/gitea
Junglewise Threat Intelligence
CVE-2026-20888: GO-2026-4366 - Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea
CVE-2026-20888 · Severity: medium · CVSS 4 · Published 2026-02-02
Technologies: code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go). Vendors: Go.
Related threats
- Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
- GO-2026-6039 - Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata in gitea.dev
- Gitea public-only token scope bypass in Organization and Permission endpoints
- Gitea SSRF and local file read via migration asset bypass