CVE-2026-20883

CVE-2026-20883: Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Vendor Gitea

Product Gitea Open Source Git Server

Weakness CWE-284

Published January 22, 2026

Last update January 23, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

Key dates

02Disclosure timeline

January 22, 2026 CVE published

January 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-20883 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Related vulnerabilities

04Related CVE

CVE-2020-1666 Junos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnection CVE-2019-11785 CVE-2025-20366 Improper Access Control in Background Job Submission in Splunk Enterprise CVE-2020-9046 Kantech EntraPass Security Management Software - System Permissions Vulnerability CVE-2024-7919 Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control