~ / search / GHSA-qm72-8prh-g92x

GHSA-qm72-8prh-g92x

Gitea tracked-time deletion is not scoped to the requested issue

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-25782

Packages

EcosystemPackageAffectedFixed in
Go code.gitea.io/gitea < 1.25.5 1.25.5

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

References

External links from the advisory. They lead to third-party sites.