EUVD-2026-41615
GHSA-fhq3-p242-2qpf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The actual impact is confidentiality leakage of time-entry data from private repositories, not integrity; no write capability exists; C:L corrects the vendor's I:L, all other metrics align with PR:N unauthenticated network access.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
AnalysisAI
Unauthorized read access to tracked time entries in Gitea before 1.25.5 exposes private repository metadata to unauthenticated network actors due to missing repository-level permission checks during API serialization (CWE-284). The flaw exists in the ToStopWatches and ToTrackedTimeList conversion functions in services/convert/issue.go, which iterated over and returned time entries without verifying the requesting user held read access to the underlying repository. No public exploit has been identified and CISA has not added this to KEV; however, the SSVC assessment designates the flaw as automatable, meaning it can be scripted at scale against all exposed Gitea instances running affected versions.
Technical ContextAI
Gitea is a self-hosted, open-source Git service written in Go. The vulnerability resides in services/convert/issue.go within the ToStopWatches and ToTrackedTimeList functions, which serialize issue time-tracking records (type issues_model.TrackedTime) into API responses. CWE-284 (Improper Access Control) is the root cause class: before the fix, the functions iterated over all time entries in scope and emitted them without calling access_model.GetUserRepoPermission to verify caller privileges against the associated repository. PRs #36662 and #36744 remediate this by introducing an ephemeral permission cache (cache.NewEphemeralCache) and gating each entry on perm.CanReadIssuesOrPulls(t.Issue.IsPull) before inclusion. Entries with a nil Issue or nil Repo are conservatively skipped. The affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:* for all versions prior to 1.25.5.
RemediationAI
Upgrade to Gitea v1.25.5 or later; this is the vendor-released patch confirmed at https://github.com/go-gitea/gitea/releases/tag/v1.25.5 and https://blog.gitea.com/release-of-1.25.5/, incorporating fixes from PRs #36662 (https://github.com/go-gitea/gitea/pull/36662) and #36744 (https://github.com/go-gitea/gitea/pull/36744). If an immediate upgrade is not feasible, restrict external access to Gitea's time-tracking API endpoints (e.g., /api/v1/repos/{owner}/{repo}/times, /api/v1/repos/{owner}/{repo}/issues/{index}/times) at the reverse proxy or firewall layer; this blocks the leak vector at the cost of disabling all API-based time-tracking queries, including legitimate ones. No configuration toggle exists in older versions to disable the vulnerable code path while retaining other functionality.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today