PT-2026-4291

CVE-2026-20888

Published

2026-01-22

Updated

2026-07-30

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea does not properly verify authorization when canceling scheduled auto-merges through the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users. This impacts the authorization process for canceling scheduled auto-merges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Spingarbor

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-284: Improper Access Control

Related identifiers