CVE-2025-68940: 
NixOS vulnerability analysis and mitigation

CVE-2025-68940 is an incorrect authorization vulnerability in Gitea that allows branch deletion permissions to be bypassed after a pull request is merged. It affects all Gitea versions before 1.22.5 and was published on December 26, 2025. The vulnerability is classified as CWE-863 (Incorrect Authorization). CVSS scores differ by source: NVD assigns 5.3 (Medium) while the CNA (MITRE) and GitHub Advisory assign 3.1 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is improper enforcement of branch deletion permissions (CWE-863) in Gitea's pull request merge workflow. When a pull request is merged, the post-merge branch deletion logic does not correctly verify whether the requesting user has the necessary permissions to delete the source branch, allowing users with insufficient privileges to trigger branch deletion. The fix was implemented in pull request #32654 by Gitea maintainer lunny, which added proper permission checks in services/repository/branch.go, routers/web/repo/pull.go, and routers/api/v1/repo/pull.go (Gitea PR #32654, Gitea Release v1.22.5).

Successful exploitation allows an authenticated user with low-level repository access to delete branches they would not normally be permitted to remove, specifically in the context of a merged pull request. This compromises repository integrity by enabling unauthorized removal of important branch references, potentially disrupting project workflows, CI/CD pipelines, and development processes. There is no confidentiality or availability impact; the impact is limited to integrity (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.02% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user account with at least some repository access, limiting the attack surface (Github Advisory, Feedly).

1. Authenticate: Log in to a Gitea instance running a version prior to 1.22.5 with a low-privileged user account that has access to a target repository but lacks branch deletion permissions.
2. Open or identify a pull request: Locate or create a pull request from a source branch to a target branch in the repository.
3. Trigger merge: Have the pull request merged (either by the attacker if they have merge rights, or by waiting for a maintainer to merge it).
4. Exploit the permission bypass: Immediately after the merge, send a branch deletion request (via the web UI or API) for the source branch. Due to the inadequate permission check in the post-merge flow, the deletion proceeds without properly validating the user's branch deletion permissions.
5. Branch deleted: The source branch is removed from the repository, disrupting workflows or removing important references (Gitea PR #32654).

• Logs: Gitea access logs showing branch deletion events (DELETE /api/v1/repos/{owner}/{repo}/branches/{branch} or equivalent web endpoint) performed by users who do not have explicit branch deletion permissions, particularly immediately following a pull request merge.
• Repository Events: Unexpected branch deletions in repository audit logs or activity feeds, especially on protected or important branches shortly after PR merges.
• API Activity: Unusual API calls to branch deletion endpoints from accounts with low privilege levels, correlating temporally with pull request merge events.

Upgrade Gitea to version 1.22.5 or later, which includes the fix for branch deletion permission checking (PR #32654). No configuration-based workaround is documented; upgrading is the only recommended remediation. As an interim measure, administrators can review and restrict repository access for untrusted users and monitor branch deletion activity in repository audit logs (Gitea Release v1.22.5, Gitea PR #32654).

The vulnerability received limited public attention given its low-to-medium severity rating. Red Hat tracked it via their security response process (Bugzilla Bug 2425461) and rated it as low priority/severity. The GitHub Advisory Database published the advisory on December 26, 2025, and SUSE also issued a related govulncheck advisory. No notable researcher commentary or significant social media discussion was identified beyond routine CVE tracking (Red Hat Bugzilla, Github Advisory).