deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-hjr9-wj7v-7hv8
Package: github.com/bishopfox/sliver (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.5.0, <= 1.5.44
Patched in: unpatched

Summary: Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass

Details:
### Summary
A specially crafted nonce routes unauthenticated requests through the NoEncoder path, where `startSessionHandler()` reads the entire request body without limits, allowing attacker-driven memory exhaustion and process crash.

### Details
- `server/encoders/encoders.go`: `EncoderFromNonce()` returns NoEncoder when `nonce % 65537 == 0` (lines 254-264); NoEncoder is a passthrough (`util/encoders/nop.go:22-32`).
- `server/c2/http.go`: `anonymousHandler()` routes requests with any encoder (including NoEncoder) to `startSessionHandler()` (lines 551-562).
- `server/c2/http.go`: `startSessionHandler()` uses `io.ReadAll(req.Body)` without a size cap (lines 564-643), unlike the authenticated path that uses `io.LimitedReader` (`readReqBody()`, lines 708-732).

### PoC
An attacker could send an HTTP POST with a nonce that is a multiple of 65537 (e.g., ?q=65537) so it is handled by startSessionHandler() with a NoEncoder, and advertise a very large Content-Length while streaming data. Because this handler uses io.ReadAll(req.Body) without a size limit, the server is expected to allocate large amounts of memory and may exhaust available RAM, leading to process termination on typical deployments.

### Impact
Unauthenticated remote DoS: attacker can crash the Sliver HTTP listener, dropping all active sessions and locking out operators until restart. No credentials or non-default config required.
GitHub Security Advisory: GHSA-4c5f-9mj4-m247
Package: github.com/open-feature/flagd/flagd (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-400: Uncontrolled Resource Consumption, CWE-407: Inefficient Algorithmic Complexity, CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 0.13.1
Patched in: 0.13.1

Summary: flagd: Multiple Go Runtime CVEs Impact Security and Availability

Details:
### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling. 

| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition:  Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAddress.  Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata. |
| CVE-2025-61723 | encoding/pem | 7.5 (High) | DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources. |
| CVE-2025-61729 | crypto/x509 | 7.5 (High) | Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes. |
| CVE-2025-58188 | net/http | Medium | Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs. |
| CVE-2025-58187 | archive/zip | Medium | DoS:  Improper validation of malformed ZIP archives.  Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers. |
GitHub Security Advisory: GHSA-4c5f-9mj4-m247
Package: github.com/open-feature/flagd/flagd-proxy (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-400: Uncontrolled Resource Consumption, CWE-407: Inefficient Algorithmic Complexity, CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 0.8.2
Patched in: 0.8.2

Summary: flagd: Multiple Go Runtime CVEs Impact Security and Availability

Details:
### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling. 

| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition:  Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAddress.  Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata. |
| CVE-2025-61723 | encoding/pem | 7.5 (High) | DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources. |
| CVE-2025-61729 | crypto/x509 | 7.5 (High) | Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes. |
| CVE-2025-58188 | net/http | Medium | Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs. |
| CVE-2025-58187 | archive/zip | Medium | DoS:  Improper validation of malformed ZIP archives.  Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers. |
GitHub Security Advisory: GHSA-4c5f-9mj4-m247
Package: github.com/open-feature/flagd/core (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-400: Uncontrolled Resource Consumption, CWE-407: Inefficient Algorithmic Complexity, CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 0.13.1
Patched in: 0.13.1

Summary: flagd: Multiple Go Runtime CVEs Impact Security and Availability

Details:
### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling. 

| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition:  Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAddress.  Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata. |
| CVE-2025-61723 | encoding/pem | 7.5 (High) | DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources. |
| CVE-2025-61729 | crypto/x509 | 7.5 (High) | Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes. |
| CVE-2025-58188 | net/http | Medium | Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs. |
| CVE-2025-58187 | archive/zip | Medium | DoS:  Improper validation of malformed ZIP archives.  Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers. |
GitHub Security Advisory: GHSA-p4f6-h8jj-vfvf
Package: github.com/mccutchen/go-httpbin (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.1.1
Patched in: unpatched

Summary: Duplicate Advisory: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

Details:
### Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-528q-4pgm-wvg2. This link is maintained to preserve external references.

### Original Description

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
GitHub Security Advisory: GHSA-p4f6-h8jj-vfvf
Package: github.com/mccutchen/go-httpbin/v2 (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.18.0
Patched in: 2.18.0

Summary: Duplicate Advisory: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

Details:
### Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-528q-4pgm-wvg2. This link is maintained to preserve external references.

### Original Description

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
GitHub Security Advisory: GHSA-pc73-rj2c-wvf9
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-204: Observable Response Discrepancy
Vulnerable versions: < 1.25.2
Patched in: 1.25.2

Summary: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

Details:
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
GitHub Security Advisory: GHSA-hmhp-gh8m-c8xp
Package: go.temporal.io/server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.29.0-0, < 1.29.0-135.0.0[PII_REDACTED]0115-b292a32bacdf
Patched in: 1.29.0-135.0.0[PII_REDACTED]0115-b292a32bacdf

Summary: Temporal has an Incorrect Authorization vulnerability

Details:
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-hmhp-gh8m-c8xp
Package: go.temporal.io/server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.29.0, < 1.29.2
Patched in: 1.29.2

Summary: Temporal has an Incorrect Authorization vulnerability

Details:
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-hmhp-gh8m-c8xp
Package: go.temporal.io/server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.28.0, < 1.28.2
Patched in: 1.28.2

Summary: Temporal has an Incorrect Authorization vulnerability

Details:
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-hmhp-gh8m-c8xp
Package: go.temporal.io/server (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.27.4
Patched in: 1.27.4

Summary: Temporal has an Incorrect Authorization vulnerability

Details:
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-qvmc-92vg-6r35
Package: github.com/mattermost/mattermost-plugin-jira (GO)
Severity: HIGH (CVSS 7.2)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: < 4.4.1
Patched in: 4.4.1

Summary: Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
GitHub Security Advisory: GHSA-qvmc-92vg-6r35
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: HIGH (CVSS 7.2)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: < 8.0.0[PII_REDACTED]2154-b57c297c6d7a
Patched in: 8.0.0[PII_REDACTED]2154-b57c297c6d7a

Summary: Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
GitHub Security Advisory: GHSA-p2gr-hm8g-q772
Package: go.temporal.io/server (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.29.0, < 1.29.2
Patched in: 1.29.2

Summary: Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts

Details:
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.
This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-p2gr-hm8g-q772
Package: go.temporal.io/server (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.28.0, < 1.28.2
Patched in: 1.28.2

Summary: Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts

Details:
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.
This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-p2gr-hm8g-q772
Package: go.temporal.io/server (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.24.0, < 1.27.4
Patched in: 1.27.4

Summary: Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts

Details:
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.
This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
GitHub Security Advisory: GHSA-fjmr-7667-8v4p
Package: github.com/golang/vscode-go (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.52.1
Patched in: 0.52.1

Summary: Visual Studio Code Go extension has unexpected untrusted code execution

Details:
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
GitHub Security Advisory: GHSA-43h9-hc38-qph5
Package: github.com/actiontech/sqle (GO)
Severity: LOW (CVSS 3.7)
CWE: CWE-321: Use of Hard-coded Cryptographic Key, CWE-798: Use of Hard-coded Credentials
Vulnerable versions: <= 4.2511.0
Patched in: unpatched

Summary: SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key

Details:
A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key.

The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.
GitHub Security Advisory: GHSA-hq57-c72x-4774
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.20.1
Patched in: 1.20.1

Summary: Gitea vulnerable to Cross-site Scripting

Details:
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
GitHub Security Advisory: GHSA-7xq4-mwcp-q8fx
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: < 1.21.2
Patched in: 1.21.2

Summary: Gitea: anonymous user can visit private user's project

Details:
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
GitHub Security Advisory: GHSA-f85h-c7m6-cfpm
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Vulnerable versions: < 1.22.2
Patched in: 1.22.2

Summary: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries

Details:
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
GitHub Security Advisory: GHSA-jhx5-4vr4-f327
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: < 1.21.8
Patched in: 1.21.8

Summary: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

Details:
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
GitHub Security Advisory: GHSA-898p-hh3p-hf9r
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.22.2
Patched in: 1.22.2

Summary: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

Details:
Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
GitHub Security Advisory: GHSA-xfq3-qj7j-4565
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.22.3
Patched in: 1.22.3

Summary: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

Details:
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
GitHub Security Advisory: GHSA-rrcw-5rjv-vj26
Package: code.gitea.io/gitea (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.22.5
Patched in: 1.22.5

Summary: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

Details:
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.