This vulnerability allows an attacker to bypass branch protection rules by retaining a stale official approval flag after a pull request (PR) is retargeted to a different branch. The stale approval is not cleared or re‑validated when the PR target changes, meaning the PR can be merged or pushes can be performed on a protected branch without revoking the previous approval. This effectively grants a user the ability to push code to protected branches, undermining the repository’s security model and enabling potential tampering or deployment of malicious code.

The affected product is Gitea, the open source Git server. No specific version range is listed in the CNA data, but the advisory references the release of Gitea 1.27.0 as a fix, indicating that versions prior to that are vulnerable.

The CVSS score is 8.1 and the EPSS score is < 1%, indicating a high severity vulnerability but a low probability of exploitation. The vulnerability is listed as not in the CISA KEV catalog. The likely attack vector is via the web interface or REST API that allows a user to retarget a PR to a new branch, after which the system mistakenly preserves the existing official approval flag. An attacker with access to create or modify PRs in a repository could exploit this to push changes to protected branches. The lack of an explicit fix or workaround in the CNA data indicates that the only reliable mitigation is to update to a patched version.