Unrated severityNVD Advisory· Published Jul 3, 2026· Updated Jul 7, 2026
Gitea tracked-time deletion can target entries from another issue
CVE-2026-25782
Description
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/go-gitea/gitea/pull/36664mitrepatch
- github.com/go-gitea/gitea/pull/36689mitrepatch
- blog.gitea.com/release-of-1.25.5/mitrerelease-notes
- github.com/go-gitea/gitea/releases/tag/v1.25.5mitrerelease-notes
News mentions
0No linked articles in our index yet.