Gitea vulnerabilities

Gitea before version 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

In Gitea before version 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. This means a user may delete a branch they should not have permission to delete.

In Gitea before 1.23.0, attackers can add attachments with forbidden file extensions by editing an attachment name via the attachment API.

Gitea before 1.25.2 mishandles authorization for deletion of releases. This flaw may allow unauthorized users to delete releases.