CVE-2026-20883: 
Gitea vulnerability analysis and mitigation

CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users with revoked repository access to continue viewing issue titles and repository names through previously started stopwatches. It affects all Gitea versions prior to 1.25.4 (Go module github.com/go-gitea/gitea). The vulnerability was published on January 22, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory).

The root cause is CWE-284 (Improper Access Control): Gitea's stopwatch API does not re-validate a user's repository access permissions when they read or list active stopwatches. When a user's access to a private repository is revoked, any stopwatches they previously started for issues in that repository remain accessible, leaking the associated issue titles and repository names. The fix, implemented in pull requests #36340 and #36368, adds additional permission checks to the stopwatch read and list operations (GitHub Advisory, Gitea PR #36340).

Exploitation allows a user whose access to a private repository has been revoked to continue reading sensitive metadata — specifically issue titles and repository names — via the stopwatch API. The impact is limited to confidentiality of repository metadata; there is no integrity or availability impact, and no evidence of lateral movement potential or code execution risk. Organizations relying on Gitea's access revocation to enforce data separation may inadvertently expose confidential project information to former collaborators (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.013–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to already have a valid Gitea account and to have previously started a stopwatch on an issue in the target private repository before their access was revoked.

1. Precondition: The attacker must have had prior access to a private Gitea repository and must have started a stopwatch on at least one issue within that repository before their access was revoked.
2. Access revocation occurs: An administrator removes the attacker's access to the private repository.
3. Query the stopwatch API: The attacker, still authenticated to the Gitea instance, sends an authenticated GET request to the stopwatch listing endpoint (e.g., /api/v1/repos/{owner}/{repo}/issues/{index}/stopwatch/list or the user-level stopwatch endpoint) using their existing session token or API key.
4. Retrieve leaked metadata: Because the API does not re-validate repository permissions, the response includes the issue title and repository name associated with the previously started stopwatch, exposing private repository metadata to the now-unauthorized user (GitHub Advisory, Gitea PR #36340).

• Network: Authenticated API requests to Gitea stopwatch endpoints (e.g., /api/v1/repos/.../issues/.../stopwatch/...) originating from users who no longer have repository access, particularly after an access revocation event.
• Logs: Gitea access logs showing stopwatch API calls from user accounts that have been removed from a private repository's collaborator list; cross-reference API access timestamps against permission change timestamps.
• Application: Presence of active stopwatch records in the Gitea database associated with users who no longer have read access to the corresponding repository.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability via additional permission checks on stopwatch read and list operations (Gitea Release v1.25.4, Gitea Blog). For environments that cannot be patched immediately, consider disabling the stopwatch/time-tracking feature or restricting API access, and audit existing stopwatch records to identify any that belong to users with revoked repository permissions. Gitea Cloud instances were automatically upgraded to v1.25.4 during the scheduled maintenance window.

The Gitea project addressed the vulnerability as part of a broader v1.25.4 security release that included multiple access control fixes. The release was positively received by the community, with 40 reactions on the GitHub release page (Gitea Release v1.25.4). No significant independent researcher commentary or media coverage specific to this CVE has been identified.