CVE-2026-20883

Опубликовано: 22 янв. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

Ссылки

https://blog.gitea.com/release-of-1.25.4/
Release Notes
https://github.com/go-gitea/gitea/pull/36340
Issue Tracking
Patch
https://github.com/go-gitea/gitea/pull/36368
Issue Tracking
Patch
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*

Версия до 1.25.4 (исключая)

EPSS

Процентиль: 26%

0.00333

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-284

Связанные уязвимости

CVE-2026-20883

CVSS3: 6.5

redhat

7 месяцев назад

CVE-2026-20883

CVSS3: 6.5

debian

7 месяцев назад

Gitea's stopwatch API does not re-validate repository access permissio ...

ROS-20260224-73-0028

CVSS3: 6.5

redos

6 месяцев назад

Уязвимость gitea

GHSA-j8xr-c56q-m8jj

github

7 месяцев назад

Gitea improperly exposes issue titles and repository names through previously started stopwatches

EPSS

Процентиль: 26%

0.00333

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-284