CVE-2026-20909
published 2026-07-03CVE-2026-20909: Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.29%
19.7th percentile
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.25.5 | 1.25.5 |
| gitea | gitea_open_source_git_server | < 1.25.5 | 1.25.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
ghsa_unreviewed·2026-07-03
CVE-2026-20909 CWE-284 Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
GHSA
Gitea exposes tracked time entries without repository authorization
ghsa·2026-07-03
CVE-2026-20909 [MEDIUM] CWE-284 Gitea exposes tracked time entries without repository authorization
Gitea exposes tracked time entries without repository authorization
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published