PT-2026-4290 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20883

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The stopwatch API in Gitea does not re-validate repository access permissions. This means that if a user’s access to a private repository is revoked, they may still be able to view issue titles and repository names through previously started stopwatches. The issue affects the ability to control access to repository information after permissions have been changed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-GITEA-2026-20883

CVE-2026-20883

GHSA-644V-XV3J-XGQG

GHSA-J8XR-C56Q-M8JJ

GO-2026-4368

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 95

• https://github.com/go-gitea/gitea/pull/36368 · Patch
• https://github.com/go-gitea/gitea/pull/36340 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20883 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4368 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20883 · Security Note
• https://osv.dev/vulnerability/GHSA-j8xr-c56q-m8jj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20883 · Vendor Advisory
• https://github.com/go-gitea/gitea/commit/95ea2df00a70176c516b12f3cfee8c84a310280f · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note