CVE-2026-25782

EUVD-2026-41626
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36664
https://github.com/go-gitea/gitea/pull/36689
https://github.com/go-gitea/gitea/releases/tag/v1.25.5