Executive brief
Gitea is a self-hosted Git service that allows teams to manage code repositories and pull requests. A flaw in permission checks allows attackers to update or rebase pull request branches without proper authorization, potentially leading to unauthorized code modifications and integrity violations.
Technical details
This vulnerability stems from incomplete access control checks (CWE-284) when users attempt to update or rebase pull request branches in Gitea. The flaw occurs in the permission validation logic that determines whether a maintainer should inherit the pull request author's permissions when the "Allow maintainer edits" feature is enabled. An unauthenticated attacker can exploit this via the network to update or rebase a pull request branch without having the required permissions, compromising code integrity. The vulnerability is patched in Gitea 1.25.5 and later versions via commits 76c539c and 99b0bf7, which add proper permission inheritance checks.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-03-16: patched: Fix released in Gitea 1.25.5
- 2026-09-01: advisory: GitHub review completed