CVE-2026-20909: Gitea Permission Check Bypass in Time Entry Listing

Technical summary

CVE-2026-20909 is a broken access control vulnerability (CWE-284) affecting Gitea's time entry listing endpoint. The vulnerability stems from insufficient permission validation when retrieving tracked time entries via the API or web interface. Unauthenticated requests or requests from users without explicit access grants can retrieve time entry data that should be access-controlled. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible exploitation requiring no authentication or user interaction, with low attack complexity. The integrity impact reflects potential unauthorized modification or exposure of audit trails rather than direct data corruption.

Business impact

For organizations running self-hosted Gitea instances, this vulnerability enables competitive or operational intelligence gathering through time tracking data. If your teams use Gitea's time tracking for billing, sprint planning, or resource allocation, an attacker could infer project scope, team capacity, or delivery schedules. In regulated environments (finance, healthcare, government), unauthorized access to work metadata may violate compliance requirements. The low barrier to exploitation (no authentication required) increases the risk of automated reconnaissance or scraping of timing information across multiple projects.

Affected systems

All Gitea installations running versions prior to 1.25.5 are affected. Self-hosted deployments are the primary target; this does not affect Gitea's cloud-hosted SaaS offerings if your organization uses them. Docker deployments, Kubernetes clusters, and bare-metal Gitea instances all require patching. The vulnerability applies regardless of repository visibility settings or user role configuration, as the permission check itself is missing rather than misconfigured.

Exploitability

This vulnerability has low exploitation barriers. No authentication, credentials, or user interaction is required; an attacker with network access to a Gitea instance can immediately enumerate time entries via repeated API calls or by browsing the web interface. Automated tools can trivially harvest timing data at scale. There is no indication this has been actively exploited in the wild, but the simplicity of discovery and low prerequisites make post-disclosure weaponization likely. Internal attackers or supply-chain adversaries targeting development infrastructure would prioritize this immediately.

Remediation

Upgrade Gitea to version 1.25.5 or later as soon as operationally feasible. This is a straightforward patch that restores proper permission checks to the time entry listing function. During your upgrade window, consider temporarily disabling time tracking features if your deployment cannot be patched immediately. Verify against the official Gitea release notes that the patch version you deploy includes the fix for this specific permission issue, as backports or point releases may vary by deployment method.

Patch guidance

Gitea updates are typically applied by updating the container image, downloading a new binary, or pulling the latest code from the repository, depending on your deployment model. For containerized deployments, pull version 1.25.5 or newer of the gitea/gitea image and restart the container with the new image. For binary deployments, download the updated executable, back up your current installation, replace the binary, and restart the Gitea service. For source deployments, pull the latest code, rebuild, and restart. No database migration or configuration changes are required. Test the upgrade in a staging environment first if possible, particularly if you rely heavily on the time tracking API for downstream integrations.

Detection guidance

Monitor your Gitea audit logs and access patterns for unauthenticated or unexpected requests to the time entry API endpoints (typically /api/v1/repos/.../times or similar REST paths). Search logs for HTTP 200 responses to time entry listing requests from IP addresses or user agents inconsistent with your normal workflows. If you run an older Gitea version, assume time entry data may have been accessed; review recent logs for enumeration patterns. Network-level monitoring should flag repeated API calls to time tracking endpoints from external IPs if your instance is internet-facing. Implement rate limiting and IP allowlisting for administrative or sensitive API paths as a compensating control until patching is complete.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability warrants near-term patching because (1) exploitation requires no authentication or privileges, (2) the attack surface is any network path to your Gitea instance, (3) time tracking data can expose business-sensitive operational details, and (4) the fix is straightforward and low-risk. It is not a critical remote code execution, but it is not a low-priority information disclosure either. Treat it as a P2 if you expose Gitea to untrusted networks; P3 if it is internal-only. Organizations in regulated industries should escalate due to potential compliance implications around audit trail integrity.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible, unauthenticated attack vector with no user interaction required and low attack complexity, offset by the fact that integrity (not confidentiality) is impacted and there is no availability impact. The score does not fully capture the business context: if your time tracking data is sensitive or if Gitea is internet-facing, the practical risk is higher than CVSS suggests. Conversely, if Gitea is strictly internal and time tracking is not sensitive, the risk is lower. Use this score as a baseline; adjust based on your own exposure and data classification.

Frequently asked questions