Executive brief
Gitea is a self-hosted Git repository management platform. The vulnerability allows attackers to view time tracking records (hours logged against issues and pull requests) from repositories they have no permission to access. This exposes sensitive project planning and resource allocation information that should only be visible to authorized team members.
Technical details
The vulnerability is an improper access control (CWE-284) issue in Gitea's time tracking API endpoints. The tracked time entries listing functionality fails to perform adequate permission checks before returning time data, allowing unauthenticated or unauthorized users to retrieve time entries from any repository. The attack requires network access to the Gitea instance and no authentication or user interaction. An attacker can call the affected API endpoints to enumerate time tracking records across repositories, disclosing information about project effort and scheduling. The vulnerability is fixed in version 1.25.5, with patches applied via pull requests #36662 and #36744.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed: CVE-2026-20909 published and advisory GHSA-fhq3-p242-2qpf reviewed by GitHub
- 2026-03-16: patched: Version 1.25.5 released with security fixes including this issue
- 2026-02-24: other: Fix merged into main branch via PR #36662
- 2026-02-25: other: Fix backported to release/v1.25 branch via PR #36744