{"id":"EUVD-2026-41626","enisaUuid":"afb32894-be18-3417-b3b9-ca2e16918701","description":"Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.","datePublished":"Jul 3, 2026, 8:19:33 PM","dateUpdated":"Jul 7, 2026, 4:59:35 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-gitea/gitea/pull/36664\nhttps://github.com/go-gitea/gitea/pull/36689\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-25782\nGHSA-qm72-8prh-g92x\n","assigner":"Gitea","epss":0.39,"enisaIdProduct":[{"id":"1e2c7426-d0b0-37b8-b8da-7946d9becccf","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"d77ead21-ddb4-30e0-9caf-bc7c3fa117e0","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"1e66710b-eefe-343b-8917-fa9cb37b6f40","vulnerability":{"id":"GHSA-qm72-8prh-g92x","description":"Gitea tracked-time deletion is not scoped to the requested issue","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:22:26 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-25782\nhttps://github.com/go-gitea/gitea/pull/36664\nhttps://github.com/go-gitea/gitea/pull/36689\nhttps://github.com/go-gitea/gitea/commit/5ad87616c9c654fc44c611ccfd4e496257c8f96b\nhttps://github.com/go-gitea/gitea/commit/8051056075719b7629eef44689b5a61d5ff080a9\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41626\n","aliases":"GHSA-qm72-8prh-g92x\nCVE-2026-25782\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b62cb087-d475-3be1-bc0b-2e1425dc8df1","vulnerability":{"id":"CVE-2026-25782","description":"Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.","datePublished":"Jul 3, 2026, 8:19:33 PM","dateUpdated":"Jul 7, 2026, 4:59:35 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/go-gitea/gitea/pull/36664\nhttps://github.com/go-gitea/gitea/pull/36689\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41626\n","assigner":"Gitea","epss":0.39,"dataProcessed":"Oct 29, 2026, 7:14:48 AM","vulnerabilityProduct":[{"id":"2d8a8e40-497d-3410-854d-bcfd2c1c65a1","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"110ff2b1-edab-32c3-b616-7eb446638890","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}