CVE-2026-20883: Gitea Auth Bypass Vulnerability

CVE-2026-20883 Overview

CVE-2026-20883 is a Broken Access Control vulnerability in Gitea's stopwatch API that fails to re-validate repository access permissions. When a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches. This vulnerability represents a significant information disclosure risk for organizations using Gitea to host private repositories.

Critical Impact

Former users with revoked access can continue to view private repository names and issue titles, potentially exposing sensitive project information and confidential business data.

Affected Products

• Gitea versions prior to 1.25.4

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-20883 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-20883

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within Gitea's stopwatch functionality. The stopwatch feature in Gitea allows users to track time spent on issues within repositories. When a user starts a stopwatch on an issue, the system creates a persistent association between the user and that issue.

The core issue lies in how Gitea handles permission checks for the stopwatch API endpoints. While Gitea properly validates permissions when a user initially accesses a repository or starts a stopwatch, subsequent API calls to retrieve stopwatch data do not re-validate whether the user still has access to the underlying repository.

This creates a window of information leakage where a user who has had their repository access revoked can continue to access metadata about private repositories through the stopwatch API. The exposed information includes repository names and issue titles, which may contain sensitive business information, project codenames, or confidential details about ongoing development efforts.

Root Cause

The root cause is insufficient authorization checks in the stopwatch API endpoints. When retrieving active or historical stopwatch data, the API returns repository and issue information without verifying that the requesting user currently has read access to the associated repository. The authorization check occurs only at the time the stopwatch is created, not when the data is subsequently retrieved.

This is a classic example of a Time-of-Check Time-of-Use (TOCTOU) authorization flaw, where permissions are validated at one point in time but not enforced consistently throughout the data lifecycle.

Attack Vector

An attacker who previously had legitimate access to a private repository can exploit this vulnerability through the following mechanism:

1. The attacker gains access to a private repository (either through legitimate means or temporary access grants)
2. While having access, the attacker starts stopwatches on one or more issues containing sensitive information
3. The attacker's access to the repository is revoked
4. Despite revocation, the attacker can query the stopwatch API endpoints to retrieve information about the private repository, including repository names and issue titles

This attack requires no special tools or techniques—simply accessing the standard stopwatch API endpoints through the Gitea interface or direct API calls is sufficient to retrieve the leaked information.

Detection Methods for CVE-2026-20883

Indicators of Compromise

• Unusual stopwatch API queries from users who no longer have repository access
• Access logs showing repeated stopwatch endpoint calls from accounts with recently revoked permissions
• API requests to /api/v1/user/stopwatches from users without corresponding repository access rights

Detection Strategies

• Monitor Gitea access logs for stopwatch API calls and correlate with current repository permission assignments
• Implement alerts for stopwatch data access attempts by users whose repository permissions have been recently modified or revoked
• Review audit logs for patterns of stopwatch creation followed by permission changes

Monitoring Recommendations

• Enable detailed API logging for stopwatch-related endpoints in Gitea
• Implement automated correlation between permission change events and subsequent API activity from affected users
• Regularly audit active stopwatches across the instance and verify that associated users still have appropriate repository access

How to Mitigate CVE-2026-20883

Immediate Actions Required

• Upgrade Gitea to version 1.25.4 or later immediately
• Review active stopwatches in your Gitea instance and identify any associated with users who no longer have repository access
• Consider clearing stale stopwatch entries for users who have been removed from repositories
• Audit recent access logs to determine if this vulnerability may have been exploited

Patch Information

Gitea has addressed this vulnerability in version 1.25.4. The fix implements proper access validation on stopwatch API endpoints to ensure users can only retrieve stopwatch data for repositories they currently have permission to access.

For detailed information about the fix, refer to the following resources:

• Gitea Release Announcement
• Gitea Pull Request #36340
• Gitea Pull Request #36368
• Gitea Release v1.25.4
• GitHub Security Advisory GHSA-644v-xv3j-xgqg

Workarounds

• If immediate upgrade is not possible, consider disabling the stopwatch feature at the instance level until patching can be completed
• Implement network-level access controls to restrict API access to the Gitea instance
• Manually delete stopwatch records for users whose repository access has been revoked
• Review and restrict API token permissions for users with reduced access needs

# Configuration example
# Example: Upgrade Gitea to patched version
# Download the latest patched release
wget https://github.com/go-gitea/gitea/releases/download/v1.25.4/gitea-1.25.4-linux-amd64

# Stop the running Gitea service
sudo systemctl stop gitea

# Replace the binary (backup first)
sudo cp /usr/local/bin/gitea /usr/local/bin/gitea.backup
sudo cp gitea-1.25.4-linux-amd64 /usr/local/bin/gitea
sudo chmod +x /usr/local/bin/gitea

# Restart Gitea
sudo systemctl start gitea

# Verify the version
gitea --version