GHSA-9cgq-wp42-4rpqMedium

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface

Published
January 23, 2026
Last Modified
January 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-20888 →

📋 Description

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.

🎯 Affected products1

  • go/github.com/go-gitea/gitea:< 1.25.4

🔗 References (6)