Listen to this Post
In Gitea before version 1.22.5, the system fails to properly enforce branch deletion permissions after merging a pull request. Normally, branch deletion requires explicit user rights, such as repository write or admin access. However, during the merge process, the code that handles the “delete source branch” option does not validate the user’s authorization. This flaw exists in the permission enforcement logic within the merge action functions. When a user merges a pull request with the delete branch flag enabled, the system directly proceeds to delete the source branch without checking if the user has the ‘delete branch’ permission. This bypasses the standard permission checks that are applied during direct branch deletion via Git commands or the UI. The vulnerability allows users with merge rights but without branch deletion permissions to indirectly delete branches. It stems from missing calls to authorization middleware in the post-merge branch deletion routine. Specifically, the function `DeleteBranch` or its equivalents is invoked without verifying the user’s role or permissions. This can be exploited in repositories where pull request mergers are not intended to delete branches. The issue affects collaborative workflows where branch protection rules are used. Although low severity, it poses a risk of unauthorized data loss or workflow disruption. The fix in 1.22.5 introduces proper permission checks before executing branch deletion after a merge, ensuring alignment with existing security policies.
Platform: Gitea
Version: versions before 1.22.5
Vulnerability: Branch deletion bypass
Severity: Low
Date: Dec 26 2025
Prediction: Patched in 1.22.5
What Undercode Say:
Analytics:
git branch -a
git merge feature-branch
git branch -d feature-branch
curl -X POST https://gitea.example.com/api/v1/repos/owner/repo/pulls/{index}/merge -H "Authorization: token <access_token>" -d '{"do":"merge","delete_branch_after_merge":true}'
How Exploit:
Merge pull request with delete branch option enabled without delete permissions.
Protection from this CVE:
Upgrade to Gitea 1.22.5.
Impact:
Unauthorized branch deletion causing data loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
