CVE-2026-20888

The Gitea platform is vulnerable to an authorization bypass (CWE-284, CWE-862) where users with read access to pull requests can cancel scheduled auto-merges created by other users. This flaw exists because the web interface fails to properly verify authorization during the cancellation process. ...