CVE-2026-20888: 
Gitea vulnerability analysis and mitigation

CVE-2026-20888 is an improper authorization vulnerability in Gitea that allows users with read-only access to pull requests to cancel auto-merges scheduled by other users via the web interface. It affects all Gitea versions prior to 1.25.4. The vulnerability was published on January 22, 2026, and the GitHub Advisory (GHSA-9cgq-wp42-4rpq) was published on January 23, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-284: Improper Access Control; CWE-862: Missing Authorization) in the web interface handler responsible for canceling scheduled auto-merges on pull requests. When a user triggers the cancel auto-merge action through the web UI, Gitea fails to verify whether the requesting user has sufficient privileges (e.g., merge permission) to perform that action — only read access to the pull request is required. The fix, implemented in pull requests #36341 and #36356, adds a proper permission check ensuring only users with merge rights can cancel auto-merges (GitHub Advisory, Fix PR #36341).

Successful exploitation allows a low-privileged user (with only read access to pull requests) to disrupt automated deployment workflows by canceling auto-merges scheduled by other users, including repository maintainers. This primarily affects availability of the auto-merge feature and can delay or block critical code changes from being merged on schedule. There is no direct confidentiality or data integrity impact, and the vulnerability does not enable lateral movement or code execution (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.017–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain read access: Authenticate to a Gitea instance (version < 1.25.4) with any account that has at least read access to pull requests in a target repository.
2. Identify a scheduled auto-merge: Browse to a pull request in the repository that has an auto-merge scheduled by another user (e.g., a maintainer or repository owner).
3. Trigger the cancel action: Via the web interface, click the "Cancel auto merge" button on the pull request page. Due to the missing authorization check, Gitea processes the cancellation without verifying that the requesting user has merge permissions.
4. Auto-merge is canceled: The scheduled auto-merge is removed, disrupting the intended automated workflow without the knowledge or consent of the user who scheduled it (GitHub Advisory, Fix PR #36341).

• Logs: Gitea web access logs showing POST requests to the cancel auto-merge endpoint (e.g., /<owner>/<repo>/pulls/<id>/auto_merge/cancel) from users who do not have merge permissions on the repository.
• Application Activity: Unexpected cancellations of scheduled auto-merges visible in pull request event history, attributed to users with only read-level access.
• Audit Trail: Gitea audit logs (if enabled) recording auto-merge cancellation events by non-maintainer accounts.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability via pull requests #36341 (main branch) and #36356 (backport to release/v1.25) (Gitea Release v1.25.4, GitHub Advisory). As a temporary workaround if patching is not immediately possible, restrict pull request read access to trusted users only, or disable the auto-merge feature until the patch is applied. Monitor pull request activity for unauthorized auto-merge cancellations.

The Gitea project released version 1.25.4 on January 22, 2026, addressing this and several other security issues, and announced the release on the official Gitea blog (Gitea Blog). Community reaction on GitHub was positive, with the release receiving over 40 reactions. No significant independent researcher commentary or broader media coverage has been identified for this specific vulnerability.