MEDIUM5.3

GHSA-qm72-8prh-g92x

Gitea tracked-time deletion is not scoped to the requested issue

Quick fix

GHSA-qm72-8prh-g92x — code.gitea.io/gitea: upgrade to the fixed version with the command below.

go get code.gitea.io/gitea@v1.25.5

Details

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/code.gitea.io/gitea

Introduced in: 0Fixed in: 1.25.5

Fixgo get code.gitea.io/gitea@v1.25.5

References

https://nvd.nist.gov/vuln/detail/CVE-2026-25782[ADVISORY]
https://github.com/go-gitea/gitea/pull/36664[WEB]
https://github.com/go-gitea/gitea/pull/36689[WEB]
https://github.com/go-gitea/gitea/commit/5ad87616c9c654fc44c611ccfd4e496257c8f96b[WEB]
https://github.com/go-gitea/gitea/commit/8051056075719b7629eef44689b5a61d5ff080a9[WEB]
https://blog.gitea.com/release-of-1.25.5[WEB]
https://github.com/go-gitea/gitea[PACKAGE]
https://github.com/go-gitea/gitea/releases/tag/v1.25.5[WEB]