{"id":"GHSA-47rq-xp99-92mx","revision":"bf57acf99e2b401dac27975ab85229c8","records":[{"revision":"bf57acf99e2b401dac27975ab85229c8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-47rq-xp99-92mx","aliases":["CVE-2026-24690","GO-2026-6334"],"title":"Gitea pull request branch permission checks allow unauthorized updates and rebases","description":"Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.","state":0,"publishedAt":"2026-07-03T21:31:37+00:00","modifiedAt":"2026-09-02T19:55:45.1812236+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.25.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-24690","https://github.com/go-gitea/gitea/pull/36465","https://github.com/go-gitea/gitea/pull/36838","https://github.com/go-gitea/gitea/commit/76c539cd572f1638c5a8a6571b0c347b277bf999","https://github.com/go-gitea/gitea/commit/99b0bf7324dec2f9b85ce33ff809d0cc2acd5864","https://blog.gitea.com/release-of-1.25.5","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.25.5"],"sourceUrl":"https://github.com/advisories/GHSA-47rq-xp99-92mx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-47rq-xp99-92mx","identifiers":["GHSA-47rq-xp99-92mx","CVE-2026-24690","GO-2026-6334"]},"retained":false,"historicalAffected":[]}],"coverage":[]}