A flaw in Gitea 1.25.5 causes a write‑permission result that is cached per branch to be reused across multiple refs within the same pre‑receive hook session. An attacker who already has maintainer‑edit rights on one branch can thus overwrite refs that belong to other branches, effectively gaining full repository write access. and alter any file in the repository, compromising all data and potentially publishing malicious code. The weakness corresponds to CWE‑863.

The vulnerability is listed for the Gitea open source Git server, specifically version 1.25.5. No other versions are explicitly stated as affected in the advisory. Version 1.26.3 and newer are referenced as containing a patch that removes the incorrect caching behavior. The product is commonly used in self‑hosted Git hosting environments.

The CVSS score of 8.8 classifies the issue as high severity, while the EPSS score of < 1% indicates a very low likelihood of attacker to be able to push to a branch for which they have maintainer‑edit rights; from that position, the pre‑receive hook mistakenly propagates the permission to other refs. Once the push succeeds, the attacker can rewrite any reference, including protected branches, leading to destructive impact. Despite the low EPSS, the denial of full‑write control is a severe outcome, warranting immediate attention.