{"id":"EUVD-2026-41615","enisaUuid":"11ec8d54-f34d-3b94-b26b-b8cf8cb970d1","description":"Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.","datePublished":"Jul 3, 2026, 8:19:29 PM","dateUpdated":"Jul 7, 2026, 5:00:40 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-gitea/gitea/pull/36662\nhttps://github.com/go-gitea/gitea/pull/36744\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-20909\nGHSA-fhq3-p242-2qpf\n","assigner":"Gitea","epss":0.39,"enisaIdProduct":[{"id":"edb61a29-290c-3c7e-b079-12843bc592f1","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"bf64a6c3-6a3e-383d-bde5-612e96039f8e","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"236cce65-0adc-3802-8281-7e83924c31dc","vulnerability":{"id":"CVE-2026-20909","description":"Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.","datePublished":"Jul 3, 2026, 8:19:29 PM","dateUpdated":"Jul 7, 2026, 5:00:40 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-gitea/gitea/pull/36662\nhttps://github.com/go-gitea/gitea/pull/36744\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41615\n","assigner":"Gitea","epss":0.39,"dataProcessed":"Nov 7, 2026, 7:22:53 AM","vulnerabilityProduct":[{"id":"5ac0db72-4675-339e-ac4b-59034f9a0216","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"8ba3d914-d4b3-34e4-a9fd-8e72bfff4ae1","vendor":{"name":"Gitea"}}]}},{"id":"494c64b9-7fd4-3404-b3a0-3a170c766762","vulnerability":{"id":"GHSA-fhq3-p242-2qpf","description":" Gitea exposes tracked time entries without repository authorization","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:17:32 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-20909\nhttps://github.com/go-gitea/gitea/pull/36662\nhttps://github.com/go-gitea/gitea/pull/36744\nhttps://github.com/go-gitea/gitea/commit/00566cc953dba772d2f38aa475d235fead461605\nhttps://github.com/go-gitea/gitea/commit/ed57c70176a6cac63f48ddf6b0d5f4f72cfea963\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41615\n","aliases":"GHSA-fhq3-p242-2qpf\nCVE-2026-20909\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}