What is the CVSS score of CVE-2026-25782?

CVE-2026-25782 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-25782?

Yes, a patch is available for CVE-2026-25782. Update the affected software to the latest version immediately.

Gitea CVE-2026-25782

EUVD-2026-41626 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-03 Gitea

GHSA-qm72-8prh-g92x

Gitea Authentication Bypass Gitea Open Source Git Server

5.3

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L because both API and web handlers require authentication; all other metrics match the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:34 vuln.today

Analysis Generated

Jul 22, 2026 - 18:34 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

AnalysisAI

Insecure direct object reference (IDOR) in Gitea's issue time-tracking feature allows authenticated users to delete tracked-time entries belonging to issues other than the one specified in the request URL. Affected are all Gitea Open Source Git Server versions before 1.25.5. The root cause is that GetTrackedTimeByID performed a database lookup using only the time entry's numeric ID, without filtering by the issue ID present in the URL path, enabling cross-issue data manipulation. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability.

Technical ContextAI

The vulnerability affects the tracked-time subsystem of Gitea (CPE: cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:*), a self-hosted Git service written in Go. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application uses an attacker-controlled path parameter - the numeric time entry ID - as the sole lookup key, without verifying that the retrieved record belongs to the issue also named in the URL. The patch diff confirms the fix: GetTrackedTimeByID was changed to include a WHERE issue_id = ? clause alongside the ID lookup, making the lookup scope-safe. Both the REST API handler (routers/api/v1/repo/issue_tracked_time.go) and the web handler (routers/web/repo/issue_timetrack.go) were affected, as both called the unscoped function. Integration tests added in the patch confirm that supplying a time ID belonging to a different issue now returns HTTP 404.

RemediationAI

Upgrade to Gitea 1.25.5 or later, which includes the scope-fixing patches from pull requests https://github.com/go-gitea/gitea/pull/36664 and https://github.com/go-gitea/gitea/pull/36689. The patched release is confirmed available at https://github.com/go-gitea/gitea/releases/tag/v1.25.5. If an immediate upgrade is not feasible, a compensating control is to disable the time-tracking feature entirely in the Gitea administration panel (Admin → Settings → Features → Enable Time Tracking), which removes the vulnerable endpoint from the attack surface; note this will prevent all time logging for all users and repositories. Restricting API token issuance and auditing existing time-tracking records for unexpected deletions across issues may also help detect exploitation of instances that cannot be patched immediately.