CVE-2026-25782 Gitea CVE debrief

Who should care

Users of Gitea versions before 1.25.5 should apply patches to prevent potential deletion of tracked-time entries across issues. This vulnerability could impact Gitea instances that have not been updated to version 1.25.5 or later. Gitea administrators and security teams should review and update their instances to ensure version 1.25.5 or later is deployed.

Technical summary

Gitea versions before 1.25.5 have a vulnerability where tracked-time entries are looked up by time ID without being scoped to the issue in the request URL. This allows for deletion attempts to target entries from another issue, potentially leading to unintended data modifications. The vulnerability is due to improper scoping of tracked-time entries, which could allow an attacker to delete tracked-time entries from other issues.

Defensive priority

Apply patches for Gitea versions before 1.25.5 to prevent tracked-time entry deletion across issues. Review and update Gitea instances to ensure version 1.25.5 or later is deployed.

Recommended defensive actions

• Apply the patch from Gitea version 1.25.5 or later.
• Review and update Gitea instances to ensure version 1.25.5 or later is deployed.
• Monitor Gitea logs for any unusual deletion attempts of tracked-time entries.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-03T21:16:58.030Z and was last modified on 2026-07-07T18:16:36.937Z. The NVD entry is currently Deferred. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.