CWE-284, representing an authorization flaw, underlies the issue in Gitea versions released before 1.25.5, where insufficient permission checks allow a user to update or rebase a pull‑request branch. The description implies that a user who should not alter the branch’s contents can succeed in doing so, enabling the introduction of malicious changes before a pull request is merged. Based on the nature of the vulnerability, it is inferred that such unauthorized changes could compromise code integrity, potentially affecting subsequent build or deployment pipelines, but the description does not explicitly mention code‑review or build impacts.

The incorrect authorization logic applies to Gitea Open Source Git Server installations with a version older than 1.25.5. Any deployment running a prior release is susceptible because the flaw exists in the core logic that governs pull‑request branch updates.

The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog; the CVE data does not provide evidence of public exploitation. The CVSS score of 7.5 indicates a high severity impact. The flaw can be exploited by any authenticated user with pull‑request interaction rights who should not have permission to rebase or replace a pull‑request branch. This condition is inferred from the described permission model. Consequently, the risk remains significant, especially in environments with permissive contributor access or loosely controlled RBAC.