Gitea
CVE-2025-68940
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with merge rights
-
ExploitMerge PR with delete-branch-after-merge enabled
-
ExecutionBranch-deletion authorization check skipped
-
ImpactUnauthorized head branch deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Gitea account with permission to merge pull requests on the target repository, and the pull request must be merged with the 'delete branch after merge' (DeleteBranchAfterMerge) option enabled via the standard GitHub-style flow. The flaw is that the branch-deletion permission (CanDeleteBranch) was not enforced on this post-merge path, so a user without branch-deletion rights can nonetheless cause the head branch to be deleted. Exploitation is limited to deletion of the pull request head branch (not arbitrary branches), does not apply to agit-flow references, and does not grant code execution or data disclosure; the practical impact is loss of integrity through unauthorized branch removal. |
| Impact | This is a modest-severity, low-priority authorization flaw (CWE-863) rather than a high-impact issue. The published CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N) rates only a Low integrity impact (I:L) with no confidentiality or availability effect, and the EPSS score of 0.27% (18th percentile) indicates very low predicted exploitation likelihood. It is NOT listed in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of real-world exploitation. A key signal conflict must be highlighted: the vector specifies PR:N (unauthenticated), yet the source-code evidence (PR #32654) shows the defect lies in the post-merge 'delete branch after merge' path, which can only be reached by a user who is already authenticated and able to merge a pull request - so PR:N is almost certainly too generous and real exploitation requires authenticated merge-capable access. Combining the low EPSS, absence of KEV/POC, limited integrity-only impact, and the authentication reality, this should be patched during normal maintenance rather than treated as an emergency. |
| Exploit ScenarioDerived | An authenticated Gitea user who holds merge rights on a repository but lacks branch-deletion permission opens or merges a pull request with the 'delete branch after merge' option enabled; because the server fails to run the branch-deletion authorization check in that path, the head branch is removed even though the user should not be allowed to delete it. No public exploit code is available, and exploitation requires a valid account with merge capability on the target repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Gitea before 1.22.5 allows an authenticated user with pull-request merge rights to delete the pull request head branch without branch-deletion permission when merging with the delete-branch-after-merge option. This is a CWE-863 incorrect authorization flaw that is assessed as a modest-severity, low-priority issue: it can cause unauthorized branch removal but does not grant code execution or data disclosure, applies only to the PR head branch, and does not affect agit-flow references. The EPSS score is low at 0.27 percent (18th percentile), no public exploit identified at time of analysis, and the vendor released a patch in Gitea 1.22.5.
RemediationAI
Vendor-released patch: 1.22.5. Upgrade Gitea to 1.22.5 or later using the release at https://github.com/go-gitea/gitea/releases/tag/v1.22.5 and the vendor advisory at https://blog.gitea.com/release-of-1.22.5/; the upstream code change is in PR https://github.com/go-gitea/gitea/pull/32654. If immediate upgrade is not possible, restrict repository merge permissions to trusted maintainers and avoid using the delete-branch-after-merge option when merging PRs from users who lack branch-deletion rights; this is only a compensating control because the underlying post-merge authorization check remains missing, and it adds manual review overhead. Do not broadly expose API merge endpoints to authenticated users who lack branch-deletion privileges, as that expands the set of users who can trigger the flawed cleanup path.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in Gitea's pull-request merge handling across router paths such as routers/api/v1/repo/pull.go and routers/web/repo/pull.go. When DeleteBranchAfterMerge was requested for GitHub-style pull requests, the post-merge cleanup path performed head-branch deletion without first calling repo_service.CanDeleteBranch to verify that the merging user had permission to delete that branch. This is CWE-863 (Incorrect Authorization): authorization logic existed for branch deletion but was not consistently enforced on the merge-triggered cleanup path. The fix adds the CanDeleteBranch permission check and restricts delete-branch-after-merge cleanup to PullRequestFlowGithub, explicitly excluding agit-flow references. The affected product is represented by CPE cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*:* and the patch is available in upstream PR 32654 for v1.22.5.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitation needs an authenticated user with merge rights, so PR:L not PR:N; impact is unauthorized branch deletion (I:L) with no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB