CVE-2026-25782: Gitea tracked-time deletion can target entries from another issue
Published Jul 3, 2026
·Updated
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
Affected Software
1 affected component
Gitea Gitea<1.25.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 1.25.5
Event History
Jul 3, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-25782?
CVE-2026-25782 has a risk level rated as 33.
2
How do I fix CVE-2026-25782?
To fix CVE-2026-25782, upgrade Gitea to version 1.25.5 or later.
3
What impact does CVE-2026-25782 have on my Gitea instance?
CVE-2026-25782 allows unauthorized deletion of tracked-time entries from different issues.
4
Are older versions of Gitea affected by CVE-2026-25782?
Yes, all Gitea versions before 1.25.5 are affected by CVE-2026-25782.
5
What should I do if I cannot upgrade to fix CVE-2026-25782 immediately?
If upgrading is not possible, implement strict access controls and monitor tracked-time entry deletions until a fix can be applied.