A flaw in the approval gating logic of Gitea Open Source Git Server permits a pull request that originates from a permanent fork to merge without fulfilling the repository’s configured approval gates, allowing an attacker to inject or modify code that would normally be protected by the approval workflow. This weakness results in the ability to alter repository contents without the necessary authorization, providing a path for privilege escalation within the repository environment.

The vulnerability affects installations of Gitea Open Source Git Server that use the approval gate workflow for pull requests. The vendor’s advisories reference fixes in releases 1.26 to1.26.4 as potentially exposed until an update is applied.

The CVSS score of 8.9 indicates high severity, while the EPSS score of < 1 % shows a low yet non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must first possess an authenticated account with permission to fork a repository and create a pull request; a merge will then bypass the intended approval checks, allowing the introduction of malicious code or alteration of existing code without the required approvals.