CVE-2026-123642 in Gitea
Summary
by MITRE • 11/15/2026
The AGit flow (pushing to `refs/for/...`) did not check the pusher's access to pull requests again when it created the pull request. A user or deploy key with read access to the code only, or with write access to the wiki over SSH, could open pull requests in a repository where they have no access to pull requests. Creating a pull request through AGit now requires read access to the pull requests of the repository and is refused for wiki pushes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The identified vulnerability represents an authorization bypass within the Git flow mechanism used by Atlassian's Bitbucket Server, specifically affecting operations involving push actions to refs/for paths which are conventionally utilized to initiate code review processes via pull requests. In a properly secured environment, any user attempting to create a pull request must possess explicit read permissions for the pull request module of the target repository. However, due to a logic error in the access control checks during the creation phase, the system failed to re-validate these specific privileges when processing pushes directed at refs/for branches. This oversight allowed individuals with insufficient privileges to bypass standard gatekeeping measures and submit code changes for review without authorization.
The technical flaw stems from an incomplete verification of user permissions during the transition from a raw git push operation to the creation of a pull request entity within the application database. When a user pushes commits to a ref/for branch, the system is designed to automatically generate a corresponding pull request. The vulnerability arises because the code path responsible for this automatic generation did not invoke the necessary permission checks associated with the pull requests feature set. Consequently, users who possessed read access to source code or write access to wiki pages via SSH could exploit this gap. These users typically have limited privileges intended only for viewing repositories or editing documentation, yet they were able to trigger actions that require higher-level permissions related to code review workflows.
The operational impact of this vulnerability is significant as it undermines the integrity of the code review process and potentially exposes sensitive logic changes to unauthorized reviewers or merges them into protected branches if subsequent approval steps are bypassed through other means. An attacker with read-only access to a repository could force-pull requests, cluttering the project's workflow and causing confusion among legitimate developers. Furthermore, in environments where wiki write permissions are granted broadly for documentation purposes, an adversary could leverage SSH-based wiki edits to execute this exploit, thereby expanding the attack surface beyond traditional code repositories into auxiliary content areas that were not intended to support pull request creation.
This issue aligns with CWE-862, which describes Missing Authorization, as the application failed to enforce required access controls on a critical function. It also relates to ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials but exploits misconfigured permissions to perform unauthorized actions within the system. The vulnerability highlights the importance of ensuring that all entry points for high-privilege operations, including those triggered by automated workflows like git pushes, undergo rigorous permission validation consistent with manual UI interactions.
To mitigate this risk and prevent further exploitation, administrators must ensure they are running a version of Bitbucket Server where this logic error has been corrected. The fix explicitly enforces that creating a pull request through the AGit flow now requires read access to the pull requests section of the repository. Additionally, pushes originating from wiki operations via SSH are now correctly refused if the user lacks appropriate permissions for pull request creation. Organizations should verify their current software version against vendor advisories and apply updates promptly to close this authorization gap and restore strict adherence to role-based access control policies within their development workflows.