Threat Intelligence Database

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Gitea versions before 1.25.5 allow a user to change another user's primary email address.

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

CriticalVulnerabilityGermanyFranceNetherlands+3#cve#cve-2026-20897#cwe-284

CVE-2026-20888 is a medium severity vulnerability in the Gitea Open Source Git Server where improper access control allows users with read access to pull requests to cancel scheduled auto-merges initiated by other users. This flaw arises from insufficient authorization checks in the web interface when handling auto-merge cancellations. Exploitation does not require user interaction but does require at least read-level privileges. The vulnerability impacts the integrity of the development workflow by enabling unauthorized interference with merge operations, though it does not affect confidentiality or availability. No known exploits are currently reported in the wild. European organizations using Gitea for source code management should review their access control policies and update or patch affected versions once fixes are available.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-20888#cwe-284