GitHub Advisoryadvisory · Go

GHSA-rrcw-5rjv-vj26 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

LOW Published 2025-12-26 Modified 2025-12-26 Official page ↗

Aliases: CVE-2025-68940
Ecosystem: Go
Packages: code.gitea.io/gitea
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-863
Reviewed: 2025-12-26

Affected packages

• Go code.gitea.io/gitea: < 1.22.5 → fixed in 1.22.5

Description

In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

Related

Alias · CVE (1)

CVE-2025-68940 In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. vulnerability

Weakness · CWE (1)

CWE-863 Incorrect Authorization weakness

References