CVE-2026-20883: Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20883?
The severity of CVE-2026-20883 is categorized as high due to the potential for unauthorized access to information after access revocation.
How do I fix CVE-2026-20883?
To fix CVE-2026-20883, upgrade to Gitea version 1.25.4 or later which includes the necessary authorization checks.
What type of information can be disclosed due to CVE-2026-20883?
CVE-2026-20883 can lead to post-revocation information disclosure, allowing users to view issue titles and repository names they should not access.
Which software is affected by CVE-2026-20883?
CVE-2026-20883 affects Gitea versions prior to 1.25.4.
What is the root cause of CVE-2026-20883?
The root cause of CVE-2026-20883 is a missing authorization check in Gitea's stopwatch API that fails to re-validate repository access permissions.