28 matches found
CVE-2026-20909
Gitea versions before 1.25.5 are vulnerable to an Access Control Bypass due to insufficient permission checks when listing tracked time entries. An attacker can access private time tracking information without proper authorization by sending crafted requests to the tracked-time list endpoint. Thi...
CVE-2026-20909
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...
CVE-2026-20909 Gitea tracked-time list endpoint has insufficient permission checks
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...
CVE-2026-20909 Gitea tracked-time list endpoint has insufficient permission checks
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...
PT-2026-55588
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description Insufficient permission checks occur when listing tracked time entries. Recommendations Update to version 1.25.5 or later...
PT-2026-55595
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time...
CVE-2026-25782: Authorization Bypass Through User-Controlled Key
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...