{"id":"EUVD-2026-41620","enisaUuid":"780e144a-736b-3793-a9e7-4b3852785e83","description":"Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:15 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36465\nhttps://github.com/go-gitea/gitea/pull/36838\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-24690\nGHSA-47rq-xp99-92mx\n","assigner":"Gitea","epss":0.45,"enisaIdProduct":[{"id":"e52e42e4-838a-308c-9c57-664acb1955dd","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"e0394c93-f1e6-3e85-9bde-9b80f8292353","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"591e0250-8890-3a0c-93c7-641a8b178bbc","vulnerability":{"id":"CVE-2026-24690","description":"Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:15 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36465\nhttps://github.com/go-gitea/gitea/pull/36838\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41620\n","assigner":"Gitea","epss":0.45,"dataProcessed":"Oct 27, 2026, 7:17:36 AM","vulnerabilityProduct":[{"id":"0b994855-d148-3c97-aa7d-acb01f514b9e","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"99efae08-becb-3aaa-b3fa-1b26f1d84468","vendor":{"name":"Gitea"}}]}},{"id":"f913845d-0c09-3a07-b217-0a2959605cff","vulnerability":{"id":"GHSA-47rq-xp99-92mx","description":"Gitea pull request branch permission checks allow unauthorized updates and rebases","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:20:06 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-24690\nhttps://github.com/go-gitea/gitea/pull/36465\nhttps://github.com/go-gitea/gitea/pull/36838\nhttps://github.com/go-gitea/gitea/commit/76c539cd572f1638c5a8a6571b0c347b277bf999\nhttps://github.com/go-gitea/gitea/commit/99b0bf7324dec2f9b85ce33ff809d0cc2acd5864\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41620\n","aliases":"GHSA-47rq-xp99-92mx\nCVE-2026-24690\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}