CVE-2026-20883 — Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and reposito…
Published: 2026-01-22 · CVSS: 6.5 · CVSS 3.1
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7