CVE-2026-20888

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	<= 1.25.3

References

https://blog.gitea.com/release-of-1.25.4/Release Notes
https://github.com/go-gitea/gitea/pull/36341Issue Tracking, Patch
https://github.com/go-gitea/gitea/pull/36356Issue Tracking, Patch
https://github.com/go-gitea/gitea/releases/tag/v1.25.4Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-ccq9-c5hv-cf64Broken Link

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208899.8A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malici CVE-2026-20899.8A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subje CVE-2026-208907.3Improper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an esc CVE-2026-208917.9Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of CVE-2026-208928.6Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbi CVE-2026-208938.5Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability CVE-2026-208944.8Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administ CVE-2026-208957.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-208969.8Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate CVE-2026-208979.1Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to CVE-2026-208987.2Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalati CVE-2026-20909.8A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /adm