CVE-2026-20888
📋 TL;DR
This vulnerability in Gitea allows users with read access to pull requests to cancel scheduled auto-merges created by other users. It's an authorization bypass that affects all Gitea instances running vulnerable versions. Any organization using Gitea for code collaboration is potentially affected.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
Malicious actors could disrupt development workflows by canceling critical auto-merges, potentially delaying releases or causing merge conflicts that require manual intervention.
Likely Case
Accidental or intentional disruption of scheduled merges by users with read-only access, causing minor workflow interruptions and requiring re-scheduling of merges.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary workflow disruption that can be quickly detected and corrected.
🎯 Exploit Status
Exploitation requires at least read access to pull requests. The vulnerability is in the web interface authorization check.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.25.4
Vendor Advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-ccq9-c5hv-cf64
Restart Required: Yes
Instructions:
1. Backup your Gitea instance and database. 2. Download Gitea 1.25.4 or later from official releases. 3. Stop the Gitea service. 4. Replace the Gitea binary with the new version. 5. Restart the Gitea service. 6. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable auto-merge functionality
allTemporarily disable scheduled auto-merges until patching can be completed
# This requires modifying repository settings or disabling the feature at the instance level
Restrict pull request access
allLimit read access to pull requests to trusted users only
# Configure repository permissions to restrict who can view pull requests
🧯 If You Can't Patch
- Implement strict access controls to limit who has read access to pull requests
- Monitor auto-merge cancellation logs and set up alerts for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if your Gitea version is below 1.25.4. The vulnerability affects all versions before this patch.Check Version:
./gitea --versionVerify Fix Applied:
After upgrading to 1.25.4 or later, verify that users with only read access cannot cancel scheduled auto-merges created by other users.📡 Detection & Monitoring
Log Indicators:
- Log entries showing auto-merge cancellations by users who only have read permissions
- Unexpected auto-merge cancellation events
Network Indicators:
- HTTP POST requests to auto-merge cancellation endpoints from unauthorized users
SIEM Query:
source="gitea.log" AND "cancel auto-merge" AND user_permission="read"