CVE-2026-25782CWE-639

Gitea tracked-time deletion can target entries from another issue

Medium · published July 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea tracked-time deletion can target entries from another issue
    cvelistv5