EUVD-2026-41615
GHSA-fhq3-p242-2qpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate Gitea instance repository paths
-
ExploitSend unauthenticated GET to time-tracking API endpoint
-
ExecutionBypass missing permission serialization check
-
ImpactReceive private repository time-tracking entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network access to a Gitea instance running a version prior to 1.25.5 - the CVSS vector (PR:N/AC:L) confirms unauthenticated, low-complexity exploitation against default configurations with no prerequisite features or settings required. Factors that limit real-world impact: (1) the attacker must know or enumerate valid repository paths on the target instance, which may require prior reconnaissance; (2) only time-tracking metadata is exposed - source code, credentials, and other repository content remain gated by separate access controls; and (3) the sensitivity of time-entry data is inherently lower than most other repository artifacts, reducing attacker ROI. |
| Impact | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) warrants scrutiny: the I:L (integrity) designation is inconsistent with the described behavior, which is a read-only leak of time-tracking data from private repositories - a confidentiality impact, not an integrity one. This appears to be an NVD scoring artifact; defenders should treat the real-world impact as C:L, not I:L. EPSS at 0.16% (5th percentile) and SSVC 'Exploitation: none' together confirm no evidence of active exploitation. Despite SSVC marking the flaw 'Automatable: yes,' the exposed data is time-tracking metadata rather than source code, credentials, or secrets, which substantially limits attacker incentive. Real-world risk is low-to-moderate: the zero-prerequisites nature (PR:N, AC:L) means any internet-facing Gitea instance silently leaks this data to unauthenticated callers, but the business impact of exposing time entries is narrow compared to higher-sensitivity disclosures. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a GET request to a public Gitea instance's time-tracking API endpoint - for example, |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized read access to tracked time entries in Gitea before 1.25.5 exposes private repository metadata to unauthenticated network actors due to missing repository-level permission checks during API serialization (CWE-284). The flaw exists in the ToStopWatches and ToTrackedTimeList conversion functions in services/convert/issue.go, which iterated over and returned time entries without verifying the requesting user held read access to the underlying repository. No public exploit has been identified and CISA has not added this to KEV; however, the SSVC assessment designates the flaw as automatable, meaning it can be scripted at scale against all exposed Gitea instances running affected versions.
RemediationAI
Upgrade to Gitea v1.25.5 or later; this is the vendor-released patch confirmed at https://github.com/go-gitea/gitea/releases/tag/v1.25.5 and https://blog.gitea.com/release-of-1.25.5/, incorporating fixes from PRs #36662 (https://github.com/go-gitea/gitea/pull/36662) and #36744 (https://github.com/go-gitea/gitea/pull/36744). If an immediate upgrade is not feasible, restrict external access to Gitea's time-tracking API endpoints (e.g., /api/v1/repos/{owner}/{repo}/times, /api/v1/repos/{owner}/{repo}/issues/{index}/times) at the reverse proxy or firewall layer; this blocks the leak vector at the cost of disabling all API-based time-tracking queries, including legitimate ones. No configuration toggle exists in older versions to disable the vulnerable code path while retaining other functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted, open-source Git service written in Go. The vulnerability resides in services/convert/issue.go within the ToStopWatches and ToTrackedTimeList functions, which serialize issue time-tracking records (type issues_model.TrackedTime) into API responses. CWE-284 (Improper Access Control) is the root cause class: before the fix, the functions iterated over all time entries in scope and emitted them without calling access_model.GetUserRepoPermission to verify caller privileges against the associated repository. PRs #36662 and #36744 remediate this by introducing an ephemeral permission cache (cache.NewEphemeralCache) and gating each entry on perm.CanReadIssuesOrPulls(t.Issue.IsPull) before inclusion. Entries with a nil Issue or nil Repo are conservatively skipped. The affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:* for all versions prior to 1.25.5.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The actual impact is confidentiality leakage of time-entry data from private repositories, not integrity; no write capability exists; C:L corrects the vendor's I:L, all other metrics align with PR:N unauthenticated network access.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
DescriptionCVE.org
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Exploit-DB