PT-2026-4290 · Gitea+1 · Gitea+1

Spingarbor · Publicado 2026-01-22 · Atualizado 2026-02-24 · CVE-2026-20883

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The stopwatch API in Gitea does not re-validate repository access permissions. This means that if a user’s access to a private repository is revoked, they may still be able to view issue titles and repository names through previously started stopwatches. The issue affects the ability to control access to repository information after permissions have been changed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BIT-GITEA-2026-20883

CVE-2026-20883

GHSA-644V-XV3J-XGQG

GHSA-J8XR-C56Q-M8JJ

GO-2026-4368

SUSE-SU-2026:0403-1

Produtos afetados

Gitea

Red Os

Referências · 95

• https://github.com/go-gitea/gitea/commit/95ea2df00a70176c516b12f3cfee8c84a310280f · Nota
• https://github.com/go-gitea/gitea/pull/36368 · Correção
• https://github.com/go-gitea/gitea/pull/36340 · Correção
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Nota
• https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://suse.com/security/cve/CVE-2026-24844 · Nota
• https://twitter.com/CVEnew/status/2014577010820186525 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-25578 · Nota
• https://suse.com/security/cve/CVE-2026-23991 · Nota