CVE-2026-20909: Gitea Privilege Escalation Vulnerability

CVE-2026-20909 Overview

CVE-2026-20909 is a broken access control vulnerability in Gitea, the self-hosted Git service. Versions before 1.25.5 perform insufficient permission checks when listing tracked time entries. Remote unauthenticated attackers can query the affected endpoint and retrieve time-tracking data they should not be authorized to view. The flaw is classified under CWE-284: Improper Access Control. The Gitea project released version 1.25.5 to address the issue.

Critical Impact
Attackers can enumerate tracked time entries from Gitea repositories without proper authorization, leading to leakage of contributor activity data and project metadata.

Affected Products

Gitea versions prior to 1.25.5
Self-hosted Gitea instances exposing the tracked time API
Gitea deployments with time tracking enabled on private repositories

Discovery Timeline

2026-07-03 - CVE-2026-20909 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-20909

Vulnerability Analysis

Gitea allows repository contributors to log time against issues and pull requests using its time-tracking feature. The endpoints that list these tracked time entries did not consistently verify that the requesting user held sufficient repository or issue permissions. As a result, users could retrieve time entries beyond the scope authorized by the repository's visibility and role model. The vulnerability affects confidentiality only; integrity and availability remain unaffected. The Exploit Prediction Scoring System currently places this issue in the lower activity band, and no public exploit code has been observed.

Root Cause

The root cause is an incomplete authorization check in the handlers that enumerate tracked time entries. The affected code paths validated authentication but did not enforce the repository-level or issue-level access constraints that apply to the underlying data. The fix, delivered through Gitea Pull Request #36662 and Gitea Pull Request #36744, tightens permission evaluation before returning time-tracking records.

Attack Vector

An attacker sends crafted HTTP requests to the Gitea API endpoints that list tracked time entries. Because the authorization check was insufficient, the server returns records associated with issues or repositories the requester should not be able to read. Exploitation requires network reachability to the Gitea instance and does not require user interaction. Sensitive metadata such as user activity patterns, effort estimates, and private issue identifiers can be exposed.

No verified proof-of-concept code is available. Refer to the Gitea 1.25.5 release notes for authoritative technical details.

Detection Methods for CVE-2026-20909

Indicators of Compromise

Repeated HTTP GET requests to /api/v1/repos/{owner}/{repo}/times or /api/v1/repos/issues/times originating from a small set of IP addresses
Anomalous API traffic patterns from accounts that historically do not interact with time-tracking endpoints
Enumeration behavior against multiple repositories or issue identifiers within short time windows

Detection Strategies

Enable Gitea access logging and alert on requests to time-tracking API paths that return non-empty responses to low-privilege or unauthenticated users
Correlate repository access logs with user role assignments to surface reads that exceed the requester's authorization
Baseline normal time-tracking API usage per user and flag statistical outliers

Monitoring Recommendations

Forward Gitea reverse-proxy and application logs to a centralized analytics platform such as Singularity Data Lake for OCSF-normalized querying and retention
Monitor for scans against /api/v1/repos/*/times endpoints across all Gitea instances
Track upgrades of Gitea binaries and container images to confirm remediation coverage

How to Mitigate CVE-2026-20909

Immediate Actions Required

Upgrade all Gitea instances to version 1.25.5 or later without delay
Audit recent access logs for unauthorized reads of tracked time entries in private repositories
Restrict network exposure of Gitea administrative and API endpoints to trusted networks where feasible

Patch Information

The vendor addressed the vulnerability in the Gitea 1.25.5 release. The fixes are tracked in Pull Request #36662 and Pull Request #36744. Administrators running container deployments should pull the updated gitea/gitea:1.25.5 image and redeploy.

Workarounds

Disable the time-tracking feature at the repository or site level until the upgrade to 1.25.5 is completed
Place Gitea behind a reverse proxy that restricts access to the affected API paths for unauthenticated clients
Limit repository visibility so that sensitive projects require authenticated organization membership

bash

# Upgrade Gitea to the patched release
docker pull gitea/gitea:1.25.5
docker stop gitea && docker rm gitea
docker run -d --name gitea \
  -p 3000:3000 -p 222:22 \
  -v /var/lib/gitea:/data \
  gitea/gitea:1.25.5

# Verify the running version
curl -s http://localhost:3000/api/v1/version