CVE-2025-68940: Gitea Auth Bypass Vulnerability

CVE-2025-68940 Overview

CVE-2025-68940 is an authorization flaw in Gitea versions prior to 1.22.5. The vulnerability stems from inadequate enforcement of branch deletion permissions after a pull request is merged. Users without sufficient repository privileges can delete branches through the post-merge workflow, bypassing the access controls that should govern branch removal.

The issue is classified as [CWE-863: Incorrect Authorization]. It affects self-hosted Gitea instances used for source code management and collaborative development. The flaw impacts integrity of repository state but does not expose confidential data or interrupt service availability.

Critical Impact
Attackers with limited repository access can delete branches after pull request merges, potentially disrupting development workflows and removing branch history that was not intended to be deleted.

Affected Products

Gitea versions prior to 1.22.5
Self-hosted Gitea Git service instances
Repositories relying on branch deletion permission enforcement post-merge

Discovery Timeline

2025-12-26 - CVE-2025-68940 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68940

Vulnerability Analysis

Gitea implements branch deletion as a common action following a pull request merge. In versions before 1.22.5, the code path that handles post-merge branch cleanup does not re-verify that the requesting user holds the permissions required to delete the source branch. The authorization check present in the standard branch deletion endpoint is not consistently applied in the merge completion flow.

This is a broken access control weakness rather than a memory safety or injection issue. The exploitation prerequisite is network access to the Gitea instance and the ability to participate in pull requests on the target repository. No user interaction from a privileged account is required after the merge action.

The impact is limited to integrity of repository branches. Confidentiality and availability are not directly affected, which aligns with the vulnerability's medium severity rating.

Root Cause

The root cause is a missing permission check in the pull request merge handler. Gitea's branch deletion API path validates that the caller has write or maintainer permissions on the branch. The post-merge deletion routine invokes branch removal without executing the same authorization gate. This inconsistency between code paths allows the check to be bypassed under specific merge conditions. Details of the fix are available in the upstream pull request.

Attack Vector

An authenticated user who can open and merge a pull request, or trigger the merge completion flow, can cause branch deletion on a branch they should not be able to remove. The attack is executed over the network through the standard Gitea web interface or API. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.251%.

See the Gitea 1.22.5 release announcement and the release tag on GitHub for the technical fix context.

Detection Methods for CVE-2025-68940

Indicators of Compromise

Unexpected branch deletion events in the Gitea audit log following pull request merges
Branch removal actions attributed to users who lack documented write or admin permissions on the affected repository
Repository activity feeds showing delete_branch events immediately after merge_pull_request events by non-privileged accounts

Detection Strategies

Review Gitea action logs and repository history for branch deletions performed by users without repository write access
Correlate pull request merge events with subsequent branch deletion events and flag mismatches in expected authorization level
Compare repository state snapshots before and after merge operations to identify unauthorized branch removals

Monitoring Recommendations

Forward Gitea webhook events and audit logs to a central logging platform for retention and correlation
Alert on branch deletion events on protected branches or branches owned by users other than the deleter
Track the Gitea server version across all deployed instances to confirm remediation coverage

How to Mitigate CVE-2025-68940

Immediate Actions Required

Upgrade all Gitea instances to version 1.22.5 or later without delay
Audit repository activity logs for unauthorized branch deletions performed since deployment
Restrict pull request merge permissions to trusted contributors until patching is verified
Enable branch protection rules on critical branches to block deletion regardless of the initiating workflow

Patch Information

Gitea addressed this issue in version 1.22.5. Details are documented in the Gitea 1.22.5 release announcement, the GitHub release tag, and the pull request implementing the fix. Administrators should apply the update through their standard package manager, container image update, or binary replacement process.

Workarounds

Enable branch protection on important branches to prevent deletion through any code path until the upgrade completes
Limit pull request merge privileges to a small set of trusted maintainers as an interim measure
Monitor branch deletion events closely and restore deleted branches from local clones or backups where required

bash

# Verify the installed Gitea version meets the fixed release
gitea --version

# Example upgrade using Docker image tag
docker pull gitea/gitea:1.22.5
docker stop gitea && docker rm gitea
docker run -d --name gitea -v /var/lib/gitea:/data gitea/gitea:1.22.5