CVE-2026-25782: Gitea Authorization Bypass in Time-Tracking Deletion

Technical summary

CVE-2026-25782 is an authorization bypass vulnerability in Gitea's time-tracking feature. The root cause is insufficient scope validation during time-entry deletion operations. When a DELETE request targets a tracked-time entry by ID, the application fails to verify that the entry belongs to the issue specified in the request URL. An attacker can craft requests to delete time entries from arbitrary issues by manipulating the time ID parameter, regardless of which issue context the request appears to come from. The vulnerability affects all versions prior to 1.25.5 and is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

This vulnerability primarily impacts teams using Gitea for project management and time tracking. While the integrity impact is limited to time-tracking data rather than code or credentials, unauthorized deletion of time entries can disrupt billing workflows, project forecasting, and audit trails. For organizations that integrate time-tracking data with payroll or client billing systems, this poses a moderate risk. The lack of authentication requirements means external attackers can exploit it without insider access, making it relevant to any publicly exposed or network-accessible Gitea instance.

Affected systems

Gitea versions before 1.25.5 are vulnerable. This includes all 1.24.x, 1.23.x, and earlier releases. Self-hosted Gitea deployments are the primary attack surface; the severity depends on whether the instance is exposed to untrusted networks. Organizations running Gitea behind firewalls with restricted network access face lower risk than those with public-facing instances. Verify your current Gitea version in the administration panel under System Settings.

Exploitability

The vulnerability is straightforward to exploit. It requires only network access to the Gitea API endpoint (no authentication needed), knowledge of a valid time entry ID, and the ability to send a DELETE request. An attacker can enumerate time-entry IDs or obtain them through prior reconnaissance. No special tools, user interaction, or complex prerequisites are required. The CVSS 3.1 score of 5.3 (MEDIUM) reflects the low attack complexity and lack of authentication, balanced against the limited scope of impact (time-tracking data only).

Remediation

Upgrade Gitea to version 1.25.5 or later. The patch implements proper scope validation to ensure time-entry deletion requests are restricted to entries belonging to the issue in the request context. After upgrading, review access logs and audit trails for any suspicious deletion activity targeting time entries across multiple issues. If you operate a Gitea instance, prioritize this update within your standard patching cycle.

Patch guidance

1. Back up your Gitea database and configuration before upgrading. 2. Download Gitea 1.25.5 or later from the official Gitea release page (gitea.io/downloads). 3. Follow the Gitea upgrade documentation for your deployment method (binary, Docker, etc.). 4. Verify the upgrade by checking the version in the Gitea web interface (Administration > System Settings > Version). 5. After upgrade, restart any associated services and validate that time-tracking functionality works as expected. 6. Test deletion of time entries to confirm the fix prevents cross-issue deletion attempts.

Detection guidance

Monitor Gitea API logs for DELETE requests to time-tracking endpoints (typically /api/v1/repos/{owner}/{repo}/issues/{index}/times/{id}). Flag requests where the time ID does not logically belong to the issue being accessed. Review deletion patterns for unusual volume or cross-issue targeting. Inspect audit logs for time-entry deletions by users who do not have legitimate access to the affected issues. If you have security monitoring in place, create alerts for failed or anomalous time-tracking modifications.

Why prioritize this

Although the CVSS score is MEDIUM and the vulnerability is not yet tracked on the KEV catalog, this issue warrants prompt attention for organizations relying on Gitea time-tracking for billing or compliance. The lack of authentication requirement and ease of exploitation make it suitable for early patching. Prioritize this above lower-impact vulnerabilities, but schedule it within your normal patching cadence rather than as an emergency out-of-band release (unless your time-tracking data feeds critical business processes).

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with low attack complexity and no authentication barrier, resulting in a moderate severity rating. The score accounts for integrity impact on time-tracking data but acknowledges the absence of confidentiality or availability impact. The vulnerability is not currently included in CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not been documented at the time of publication. Organizations should still treat this as a credible risk given the simplicity of exploitation.

Frequently asked questions