PT-2026-4291 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20888

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea does not properly verify authorization when canceling scheduled auto-merges through the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users. This impacts the authorization process for canceling scheduled auto-merges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

BIT-GITEA-2026-20888

CVE-2026-20888

GHSA-9CGQ-WP42-4RPQ

GHSA-CCQ9-C5HV-CF64

GO-2026-4366

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 96

• https://github.com/go-gitea/gitea/pull/36341 · Patch
• https://github.com/go-gitea/gitea/pull/36356 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-ccq9-c5hv-cf64 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cgq-wp42-4rpq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20888 · Security Note
• https://osv.dev/vulnerability/GO-2026-4366 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20888 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20888 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-gitea-cve-2026-20888-7.3 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note