6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20883

CVE-2026-20883: Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20883

CVE-2026-20883:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-gitea/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the convert.ToStopWatches function, which was responsible for converting stopwatch data for API responses. This function failed to perform authorization checks to verify if the user making the request had the necessary permissions to view the repositories and issues linked to the stopwatches. As a result, users whose access to a private repository had been revoked could still see issue titles and repository names through API endpoints that exposed stopwatch information.

The patch addresses this flaw by modifying the convert.ToStopWatches function to accept the user performing the action (the 'doer') as an argument. It then introduces a permission check (access_model.GetUserRepoPermission) within the function to ensure the user has read access to the repository before including its stopwatch data in the response. Consequently, the API and web endpoints (repo.GetStopwatches and user.GetStopwatches) that use this function were updated to pass the current user's context. Additionally, the fix includes proactive measures to delete a user's stopwatches for a repository (issues_model.RemoveStopwatchesByRepoID) when their collaboration or team membership is revoked, preventing stale data from being accessed.

Vulnerable functions

convert.ToStopWatches

services/convert/issue.go

This function was vulnerable because it converted internal stopwatch data to an API response without checking if the user making the request had permission to view the associated repositories and issues. The patch added a 'doer' argument and permission checks.

repo.GetStopwatches

routers/api/v1/repo/issue_stopwatch.go

This API endpoint function was an entry point for the vulnerability. It called the insecure `convert.ToStopWatches` function without providing the user context needed for a permission check. An attacker could use this endpoint to view information they were no longer authorized to see.

user.GetStopwatches

routers/web/user/stop_watch.go

This web endpoint function was an entry point for the vulnerability. It called the insecure `convert.ToStopWatches` function without providing the user context needed for a permission check, allowing unauthorized access to issue and repository data.

manager.run.func1

modules/eventsource/manager_run.go

This function, running as part of the event source manager, was another vector for the vulnerability. It called `convert.ToStopWatches` without user context, which could lead to information disclosure through server-sent events. The patch adds the user context to the call.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.