CVE-2026-20888: Gitea Auth Bypass Vulnerability

CVE-2026-20888 Overview

CVE-2026-20888 is an authorization bypass vulnerability in Gitea, a self-hosted Git service. The vulnerability exists in the web interface's handling of scheduled auto-merge cancellation requests. Gitea does not properly verify authorization when canceling scheduled auto-merges, allowing users with only read access to pull requests to cancel auto-merges scheduled by other users.

This represents a broken access control issue (CWE-284: Improper Access Control) where the application fails to enforce proper authorization checks before allowing privileged operations. An attacker with minimal repository permissions could disrupt development workflows by canceling legitimate auto-merge operations scheduled by other contributors.

Critical Impact

Users with read-only access to pull requests can cancel auto-merges scheduled by other users, potentially disrupting CI/CD pipelines and development workflows in affected Gitea instances.

Affected Products

• Gitea versions prior to 1.25.4

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-20888 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-20888

Vulnerability Analysis

This vulnerability stems from improper access control in Gitea's auto-merge functionality. The auto-merge feature allows repository maintainers to schedule pull requests to be automatically merged once certain conditions are met (such as passing CI checks or receiving required approvals).

The flaw occurs because the web interface endpoint responsible for canceling scheduled auto-merges does not properly validate whether the requesting user has the appropriate permissions to perform this action. Instead of requiring write access or ownership of the scheduled auto-merge, the system only checks for read access to the pull request.

This creates a privilege escalation scenario where lower-privileged users can perform actions that should be restricted to maintainers or the original auto-merge scheduler.

Root Cause

The root cause is insufficient authorization validation in the auto-merge cancellation handler. The application checks whether a user can view the pull request but fails to verify whether that user has permission to modify or cancel auto-merge settings. According to Gitea Pull Request #36341 and Gitea Pull Request #36356, the fix introduces proper authorization checks to ensure only users with appropriate permissions can cancel scheduled auto-merges.

Attack Vector

An attacker with read access to a repository's pull requests could exploit this vulnerability through the web interface. The attack requires:

1. A valid Gitea account with at least read access to the target repository
2. Knowledge of active pull requests with scheduled auto-merges
3. Access to the web interface to trigger the cancellation request

The attacker would navigate to a pull request with a scheduled auto-merge and use the web interface to cancel the auto-merge operation, even though they lack the proper authorization to do so. This attack is relatively simple to execute and requires no specialized tools or techniques.

Detection Methods for CVE-2026-20888

Indicators of Compromise

• Unexpected cancellation of scheduled auto-merges in repository activity logs
• Auto-merge cancellation events triggered by users who did not create the original auto-merge
• Audit log entries showing auto-merge cancellations from accounts with read-only permissions
• User complaints about disrupted auto-merge workflows

Detection Strategies

• Review Gitea audit logs for auto-merge cancellation events and correlate with user permission levels
• Monitor for patterns of auto-merge cancellations by users who are not pull request authors or maintainers
• Implement alerting on auto-merge state changes for critical repositories
• Cross-reference auto-merge cancellation timestamps with the original scheduler's activity

Monitoring Recommendations

• Enable comprehensive audit logging in Gitea to capture all auto-merge related actions
• Configure alerts for auto-merge cancellations in production or release branches
• Regularly audit user permissions to identify potential abuse of read access
• Monitor for unusual patterns of auto-merge cancellations across multiple repositories

How to Mitigate CVE-2026-20888

Immediate Actions Required

• Upgrade Gitea to version 1.25.4 or later immediately
• Review recent auto-merge cancellation events in audit logs to identify potential exploitation
• Audit repository permissions and remove unnecessary read access from untrusted users
• Consider temporarily disabling auto-merge functionality on critical repositories until patching is complete

Patch Information

Gitea has released version 1.25.4 which addresses this authorization bypass vulnerability. The fix is detailed in Gitea Pull Request #36341 and Gitea Pull Request #36356. For complete release details, see the Gitea Release Announcement and Gitea Release Tag v1.25.4.

The GitHub Security Advisory GHSA-ccq9-c5hv-cf64 provides additional technical details about the vulnerability and recommended remediation steps.

Workarounds

• Restrict repository read access to only trusted users until the patch can be applied
• Disable the auto-merge feature at the instance or repository level if not critical to workflows
• Implement additional monitoring on auto-merge operations to detect unauthorized cancellations
• Use API-based auto-merge workflows with additional authentication layers where possible

# Upgrade Gitea to patched version
# Stop Gitea service
sudo systemctl stop gitea

# Download and install Gitea 1.25.4 or later
wget https://dl.gitea.com/gitea/1.25.4/gitea-1.25.4-linux-amd64
chmod +x gitea-1.25.4-linux-amd64
sudo mv gitea-1.25.4-linux-amd64 /usr/local/bin/gitea

# Restart Gitea service
sudo systemctl start gitea

# Verify version
gitea --version