CVE-2026-25782: Gitea Auth Bypass Vulnerability

CVE-2026-25782 Overview

CVE-2026-25782 is an authorization flaw in Gitea versions before 1.25.5. The application looks up tracked-time entries by time ID without scoping the query to the issue referenced in the request URL. An authenticated user can submit a deletion request that targets a tracked-time entry belonging to a different issue than the one identified in the URL path. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key, a form of Insecure Direct Object Reference (IDOR). Gitea released version 1.25.5 to correct the lookup logic and enforce issue scoping on delete operations.

Critical Impact
Attackers can delete tracked-time records associated with issues they should not be able to modify, corrupting time-tracking data across a Gitea instance.

Affected Products

Gitea versions prior to 1.25.5
Self-hosted Gitea Git service deployments
Gitea instances exposing the tracked-time REST API

Discovery Timeline

2026-07-03 - CVE-2026-25782 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-25782

Vulnerability Analysis

Gitea exposes issue-level tracked-time entries through REST endpoints that include both an issue identifier and a time entry identifier in the request path. The vulnerable code path resolves the time entry solely by its primary key. It does not verify that the retrieved entry belongs to the issue named in the URL. When a delete handler processes the request, the mismatched scope allows the operation to affect an unrelated record.

This is an Insecure Direct Object Reference issue. The application trusts the user-supplied time ID as an authoritative selector without cross-checking the parent issue relationship. Any authenticated principal with permission to delete tracked time on one issue can craft a request that removes tracked-time entries linked to different issues, including issues owned by other users or repositories.

The fix landed in Gitea Pull Request #36664 and a follow-up in Gitea Pull Request #36689. Both changes constrain lookups so that the time entry must belong to the issue specified in the request.

Root Cause

The database query used to retrieve tracked-time rows for deletion filters only by time ID. The issue ID from the URL is not applied as a predicate. This missing scope check breaks the object ownership boundary that the API contract implies.

Attack Vector

Exploitation requires network access to the Gitea HTTP API and a valid session or token with tracked-time delete privileges on at least one issue. The attacker sends a delete request whose URL references an accessible issue while supplying the time ID of a target entry on a different issue. The server executes the deletion against the target entry.

Detection Methods for CVE-2026-25782

Indicators of Compromise

Unexpected disappearance of tracked-time entries in issues where no authorized user performed a deletion.
Delete requests to /repos/{owner}/{repo}/issues/{index}/times/{id} where the {id} value does not belong to the referenced issue.
Audit log entries showing tracked-time deletions initiated by accounts with no legitimate access to the affected repository.

Detection Strategies

Review Gitea access logs for DELETE requests to tracked-time endpoints and correlate the time ID against the issue ID referenced in the same URL.
Query the Gitea database for orphaned or missing issue_tracked_time rows and cross-reference deletion timestamps with API request logs.
Alert on high volumes of tracked-time delete calls from a single account or token within a short window.

Monitoring Recommendations

Forward Gitea application and reverse-proxy access logs to a central logging platform for retention and correlation.
Track authentication events tied to API tokens used against /api/v1/repos/*/issues/*/times/* paths.
Establish a baseline for normal tracked-time deletion volume per repository and alert on deviations.

How to Mitigate CVE-2026-25782

Immediate Actions Required

Upgrade all Gitea instances to version 1.25.5 or later, as published in the Gitea Release v1.25.5.
Rotate API tokens for any accounts that may have been used to test unauthorized deletion.
Audit tracked-time records against backups to identify unauthorized deletions.

Patch Information

Gitea addressed the flaw in version 1.25.5. See the Gitea Release Announcement for full release notes. The corrective changes are in Gitea Pull Request #36664 and Gitea Pull Request #36689, which scope tracked-time lookups by issue ID before deletion.

Workarounds

Restrict access to the Gitea API using network controls or authenticated reverse proxies until the upgrade is applied.
Reduce issue tracking permissions for untrusted collaborators to limit which accounts can invoke tracked-time delete endpoints.
Enable database-level backups and short-interval snapshots so tracked-time deletions can be reversed if abuse occurs.

bash

# Verify installed Gitea version
gitea --version

# Upgrade example for a systemd-managed Gitea deployment
systemctl stop gitea
wget https://dl.gitea.com/gitea/1.25.5/gitea-1.25.5-linux-amd64 -O /usr/local/bin/gitea
chmod +x /usr/local/bin/gitea
systemctl start gitea