Gitea Branch Deletion Permission Vulnerability After Pull Request Merge

A vulnerability exists in Gitea versions prior to 1.22.5, where branch deletion permissions are not properly enforced after a pull request has been merged. This oversight could potentially allow unauthorized users to delete branches that they should not have permission to remove.

Impact

Exploitation of this vulnerability could lead to unauthorized branch deletions, potentially disrupting the workflow and version control process.

Reproduction

To reproduce this vulnerability, merge a pull request in a Gitea repository version prior to 1.22.5. After merging, attempt to delete a branch. The branch deletion may be improperly authorized, allowing deletion contrary to the established permissions.

Remediation

Users can upgrade to Gitea version 1.22.5 or later, where this vulnerability has been fixed.