A workflow approval bypass vulnerability in Gitea Open Source Git Server compromises the integrity of the code review process by allowing unauthorized pull request merges.

The vulnerability involves a logic flaw in the permanent fork PR workflow, which fails to properly enforce approval gates. This allows authenticated users with sufficient repository access to bypass mandatory review processes and merge code changes without authorization.

Exploitation of this flaw undermines the secure software development lifecycle (SDLC) by enabling the injection of unverified or malicious code into protected branches. With a CVSS score of 8.9, this vulnerability poses a high risk to code integrity, which could be leveraged to introduce backdoors or supply chain vulnerabilities into the production environment.

Immediate Action: Apply the vendor-provided security update immediately upon release to restore integrity to the pull request approval gates.

Proactive Monitoring: Audit recent pull request activity and merge history to identify any code changes that were merged without the required approvals.

Compensating Controls: Enforce manual code reviews via external process or implement branch protection rules that require administrative intervention for critical merges.

Public Exploit Available: false

This vulnerability represents a significant breakdown in repository governance. Organizations should treat this as a high-priority issue and ensure that all development workflows are re-validated once the patch is applied to ensure no unauthorized code was introduced during the vulnerable window.