Executive brief
Gitea, a self-hosted Git repository management platform, contains an authorization flaw in its time tracking feature. Attackers can delete time-tracking entries belonging to other users' issues by manipulating the request, potentially causing data loss and disrupting accurate project time reporting. This affects Gitea installations before version 1.25.5.
Technical details
This vulnerability is an authorization bypass (CWE-639) in Gitea's time tracking API endpoint. The vulnerable code performs a lookup of tracked-time entries by time ID alone, without validating that the time entry belongs to the issue specified in the request URL. This allows an attacker to craft a DELETE request targeting a time entry from a different issue. No authentication bypass is required—the attack exploits insufficient authorization scope validation. An unauthenticated or authenticated attacker with network access to the Gitea instance can delete time entries they do not own. The fix, released in version 1.25.5, adds proper scoping to ensure time entry lookups are restricted to the requested issue. The vulnerability was patched in commits 5ad8761 and 8051056.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed
- 2026-03-16: patched: Gitea 1.25.5 released with fix