GHSA-649p-mmhf-85c7: Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea has a caching bug in its pre-receive hook (the code that checks permissions before accepting a git push) where branch-specific write permission is checked only once and reused for all branches in the same push batch. This allows an attacker with legitimate write access to one branch (like via a pull request) to bypass protections and write to any branch, including main, by pushing multiple branches at once.