Listen to this Post
The vulnerability exists within Gitea’s stopwatch feature API endpoints. When a user starts a stopwatch to track time spent on a private repository issue, the system records their permissions at that moment. The flaw occurs when the user’s access rights to that repository are later revoked (e.g., removed as a collaborator). The stopwatch API endpoints, when queried to list a user’s active stopwatches, fail to perform a fresh authorization check against the current repository permissions. Instead, they return cached metadata, including the issue and repository name, based on the initial valid access. This allows the unauthorized user to infer sensitive information about ongoing work in private repositories they can no longer access, constituting an information disclosure issue.
DailyCVE Form:
Platform: Gitea
Version: < 1.22.6
Vulnerability: Improper Access Control
Severity: Low
date: 2026-01-22
Prediction: Patch 2026-01-30
What Undercode Say:
Analytics:
`curl -H “Authorization: token $TOKEN” https://gitea.instance.com/api/v1/user/stopwatches`
No public exploit code available at advisory publication.
How Exploit:
Proof-of-concept not provided.
Protection from this CVE
Update to patched version.
Disable stopwatch feature.
Impact:
Information disclosure only.
Low severity risk.
No code access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
