CVE-2026-20888

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users...

CVE-2022-0905

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...