Vulnerability advisory
GO-2026-4368
Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
Also known as BIT-gitea-2026-20883CVE-2026-20883GHSA-644v-xv3j-xgqgGHSA-j8xr-c56q-m8jj
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 1.25.4 | 1.25.4 |
Description
Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
References
- Advisorygithub.com/advisories/GHSA-j8xr-c56q-m8jj ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-20883 ↗
- Webblog.gitea.com/release-of-1.25.4 ↗
- Webgithub.com/go-gitea/gitea/commit/95ea2df00a70176c516b12f3cfee8c84a310280f ↗
- Webgithub.com/go-gitea/gitea/pull/36340 ↗
- Webgithub.com/go-gitea/gitea/pull/36368 ↗
- Webgithub.com/go-gitea/gitea/releases/tag/v1.25.4 ↗