CVE-2026-24690: Gitea Insufficient Permission Checks for Pull Request Branches (7.5 HIGH)

Technical summary

CVE-2026-24690 stems from insufficient authorization validation in Gitea's pull request branch manipulation logic. The vulnerability allows an unauthenticated network-based attacker to bypass permission checks and perform update or rebase operations on pull request branches. The flaw is rooted in CWE-284 (Improper Access Control / Permissions), which indicates that the application fails to properly enforce access restrictions. Because the attack requires no authentication or user interaction and network accessibility, the CVSS v3.1 score of 7.5 (HIGH) reflects the integrity risk posed by unauthorized code branch modifications.

Business impact

Organizations running self-hosted Gitea instances face risk of code repository integrity compromise. Attackers could silently rebase or update pull request branches to inject malicious code, inject vulnerabilities, or alter commit history without detection. This is especially damaging in environments where pull request reviews are a control point for code quality and security. Compromised branches could lead to backdoored releases, supply chain contamination, or loss of audit trails. The impact is heightened in organizations that rely on Gitea for internal development or that integrate it into CI/CD pipelines without additional controls.

Affected systems

All Gitea installations running versions prior to 1.25.5 are affected. This includes organizations using older branches of Gitea in production environments. Self-hosted instances are directly impacted; cloud-hosted or SaaS Gitea offerings depend on whether the provider has patched to 1.25.5 or later. Teams should verify their Gitea version against the vendor release history and patch status.

Exploitability

Exploitation is straightforward and requires no authentication, user interaction, or special network conditions. An attacker needs only network access to the Gitea instance and knowledge of a valid pull request to target. The low attack complexity and lack of authentication requirements make this vulnerability attractive to opportunistic attackers. However, exploitation is not currently listed in the CISA KEV catalog, indicating no widespread weaponized proof-of-concept or active in-the-wild campaigns have been cataloged as of the advisory date.

Remediation

Upgrade Gitea to version 1.25.5 or later immediately. This is a straightforward patching scenario with a defined minimum safe version. After upgrading, verify that permission checks for pull request operations are functioning correctly by testing in a non-production environment. Organizations unable to upgrade immediately should consider restricting network access to Gitea instances to trusted networks or implementing additional authorization logic at a reverse-proxy or API gateway layer, though this is not a substitute for patching.

Patch guidance

Update Gitea installations to version 1.25.5 or any subsequent release. Consult the official Gitea release notes and security advisories for any prerequisites or migration guidance specific to your deployment. If you operate a Gitea cluster or multi-instance setup, ensure all nodes are updated consistently. Test pull request update and rebase operations post-patch to confirm permission enforcement is restored.

Detection guidance

Monitor Gitea audit and access logs for suspicious pull request branch update or rebase activity, particularly requests from unauthenticated sources or with unexpected source IPs. Flag any updates to pull request branches that do not correlate with legitimate developer activity. Examine pull request commit histories for unexpected rebases or modifications. If detailed audit logging is not currently enabled, activate it prior to patching to establish a baseline for detection. Network-level monitoring for frequent or failed pull request API calls from external sources may also indicate exploitation attempts.

Why prioritize this

HIGH severity, no authentication required, direct impact on code integrity, and wide applicability across self-hosted Gitea deployments make this a priority for immediate patching. The vulnerability directly enables supply chain and repository integrity attacks. Although not yet in active exploitation per the KEV catalog, the low barrier to exploitation and high impact justify urgent remediation.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a network-accessible vulnerability requiring no authentication or user interaction, with high integrity impact (unauthorized modification of pull request branches) but no confidentiality or availability impact. The straightforward attack vector and absence of complex preconditions elevate the score despite the integrity-focused impact scope.

Frequently asked questions