CVE-2026-123642

Gitea pull request creation without pull request access through AGit

View on CVE.org
Published Nov 15, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
The AGit flow (pushing to `refs/for/...`) did not check the pusher's access to pull requests again when it created the pull request. A user or deploy key with read access to the code only, or with write access to the wiki over SSH, could open pull requests in a repository where they have no access to pull requests. Creating a pull request through AGit now requires read access to the pull requests of the repository and is refused for wiki pushes.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description The AGit flow (pushing to `refs/for/...`) did not check the pusher's access to pull requests again when it created the pull request. A user or deploy key with read access to the code only, or with write access to the wiki over SSH, could open pull requests in a repository where they have no access to pull requests. Creating a pull request through AGit now requires read access to the pull requests of the repository and is refused for wiki pushes.
Title Gitea pull request creation without pull request access through AGit
Weaknesses CWE-862
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Gitea
Published
Updated
Nov 15, 2026, 9:14 PM
Reserved
Nov 15, 2026, 8:31 PM

View source JSON

No data.

No data.

No data.

No data.