UNKNOWN Go
Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea
GO-2026-6339 · CVE-2026-20909 · GHSA-fhq3-p242-2qpf
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea
References
- ADVISORY https://github.com/advisories/GHSA-fhq3-p242-2qpf
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20909
- WEB https://blog.gitea.com/release-of-1.25.5
- WEB https://github.com/go-gitea/gitea/commit/00566cc953dba772d2f38aa475d235fead461605
- WEB https://github.com/go-gitea/gitea/commit/ed57c70176a6cac63f48ddf6b0d5f4f72cfea963
- WEB https://github.com/go-gitea/gitea/pull/36662
- WEB https://github.com/go-gitea/gitea/pull/36744
- WEB https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Ready to move
Start Securing
Free, no credit card | First findings in minutes