What is the CVSS score of CVE-2026-24690?

CVE-2026-24690 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-24690?

Gitea versions prior to 1.25.5 contain an access control flaw allowing users to bypass branch protection and modify pull requests without proper authorization, creating significant code integrity and…. A patch is available.

How to fix or mitigate CVE-2026-24690?

Within 24 hours, inventory all Gitea deployments and identify instances running versions before 1.25.5. Within 7 days, prioritize patching to Gitea 1.25.5 or later in staged rollouts, testing thoroughly in non-production environments first. Within 30 days, complete production deployment of patched versions and audit recent pull request activity across all repositories for unauthorized changes.

Gitea CVE-2026-24690

EUVD-2026-41620 HIGH

Improper Access Control (CWE-284)

2026-07-03 Gitea

GHSA-47rq-xp99-92mx

Gitea Authentication Bypass Gitea Open Source Git Server

7.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable PR feature with low complexity, but requires an authenticated account able to reach the pull request (PR:L not PR:N); impact is integrity-only, so C:N/A:N and I:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:36 vuln.today

Analysis Generated

Jul 22, 2026 - 18:36 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

HIGH 7.5

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

AnalysisAI

Improper access control in Gitea before 1.25.5 allows users to update or rebase pull request head branches without holding the write/force-push permissions those actions require, letting them push base-branch commits or rewrite history on branches they should not control. The flaw stems from the IsUserAllowedToUpdate logic in services/pull/update.go, which failed to properly re-check repository push and branch-protection permissions on the head branch. This is an integrity-only issue (CVSS 7.5, I:H) with no confidentiality or availability impact; SSVC lists exploitation as none and EPSS is low (0.16%), and no public exploit identified at time of analysis.

Technical ContextAI

Gitea is a self-hosted, lightweight open-source Git service (the CPE cpe:2.3:a:gitea:gitea_open_source_git_server) providing repository hosting, pull requests, and branch protection. The root cause is CWE-284 (Improper Access Control): the pull-request 'Update by rebase/merge' feature computes whether a user may push new commits to the PR head branch, but the pre-1.25.5 IsUserAllowedToUpdate function did not correctly enforce push permission and branch-protection force-push rules on the head repository/branch. The upstream fix (PR 36465, refined by PR 36838) refactors the check into a dedicated isUserAllowedToPushOrForcePushInRepoBranch helper that evaluates both repository write permission (CanWrite on the code unit) and any matching protected-branch rule (CanUserPush/CanUserForcePush), and only inherits the PR poster's permissions when AllowMaintainerEdit is set and the user is a legitimate maintainer able to merge the PR.

RemediationAI

Vendor-released patch: 1.25.5 - upgrade all Gitea instances to 1.25.5 or later, which refactors the pull-request update/rebase permission check to properly validate head-repository push permission and branch-protection force-push rules (see https://github.com/go-gitea/gitea/releases/tag/v1.25.5 and https://blog.gitea.com/release-of-1.25.5/). If immediate upgrade is not possible, reduce exposure by tightening who can interact with pull requests: enforce branch protection on head/fork branches, restrict repository write and force-push whitelists to trusted maintainers, and disable 'Allow maintainers to edit' (AllowMaintainerEdit) on sensitive pull requests where inherited permissions are a concern - noting these controls limit collaboration workflows and do not fully close the underlying access-control gap. Monitor repository push and PR-update activity for unexpected branch updates until patched.