CVE-2026-25782

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

5.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N                                    

Vulnerability Description

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

Vulnerability Details

Published Date

July 03, 2026

Last Modified

July 07, 2026

CWE ID

CWE-639

Source

NVD

Vendor

Gitea

Product

Gitea Open Source Git Server

External References

https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36664
https://github.com/go-gitea/gitea/pull/36689
https://github.com/go-gitea/gitea/releases/tag/v1.25.5

CVE-2026-25782

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment