A flaw in Gitea Open Source Git Server’s approval‑gate logic allows a pull request that originates from a permanent fork to merge without satisfying the repository’s configured approval gates. The result is that code can be introduced into the protected branch without the approvals that are normally required, effectively elevating the privileges of an attacker who can create such a pull request. This vulnerability is associated with the weaknesses of unauthorized access control and improper authorization decisions, reflected in CWEs 285, 732 and 863.

The vulnerability affects installations of Gitea Open Source Git Server using the approval‑gate workflow and permanent forks feature. Version information is not provided in the advisory; any deployment that employs these features without a later update that contains the fix may be susceptible.

The CVSS score of 8.9 denotes high severity, while the EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation at present. It is not listed in CISA’s KEV catalogue. The attack likely requires a user with permission to fork a repository and submit a pull request; a successful merge will bypass the intended gates and allow code injection. The vulnerability is therefore a serious risk to confidentiality, integrity and availability of the protected code base.