Description

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

Related CPE's

Could not find any relations

References

https://blog.gitea.com/release-of-1.25.5/

https://github.com/go-gitea/gitea/pull/36664

https://github.com/go-gitea/gitea/pull/36689

https://github.com/go-gitea/gitea/releases/tag/v1.25.5

Weaknesses

88ee5874-cf24-4952-aea0-31affedb7ff2

Secondary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 · Medium

Information

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Vulnerability status

Deferred

Published

2026-07-03T21:16:58.030Z

3 months ago

Last modified

2026-07-07T18:16:36.937Z

3 months ago