Summary
CVE-2026-24690 is a high-severity improper authorization vulnerability in Gitea Open Source Git Server affecting all versions prior to 1.25.5. The flaw stems from insufficient permission checks in the pull request branch update and rebase functionality, allowing a network-accessible attacker with no credentials to modify pull request branch content without authorization. It carries a CVSS v3.1 score of 7.5 (High) and poses a direct threat to the integrity of software development pipelines.
Technical details
- Root cause: Gitea failed to properly validate whether a requesting user held the required permissions before allowing pull request branch update or rebase operations. The authorization gate for these sensitive repository actions could be bypassed entirely.
- Trigger conditions: An unauthenticated or unauthorized attacker sends a crafted network request targeting the pull request branch update or rebase endpoint on an exposed Gitea instance. No user interaction or prior privileges are required.
- Attack vector: Remotely exploitable over the network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N).
- Impact: A successful exploit allows an attacker to silently modify the content of any open pull request branch. In software development environments, this enables malicious code injection into branches awaiting review or merge, creating a direct supply chain attack vector. There is no confidentiality or availability impact; the impact is entirely to integrity (I:H).
- No public proof-of-concept was identified at the time of this publication.
Affected software
- Gitea Open Source Git Server — all versions before 1.25.5
Severity
CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Mitigation and recommended actions
- Immediate action: Upgrade to Gitea 1.25.5 or later, which contains the vendor-confirmed fix for this vulnerability.
- If immediate patching is not possible: Restrict network access to Gitea instances so that only trusted, authenticated users can reach pull request endpoints. Consider placing Gitea behind a VPN or authenticated reverse proxy to eliminate unauthenticated exposure to the update/rebase endpoints.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

