CVE-2026-20909 affects Gitea Open Source Git Server versions before 1.25.5. The vulnerability arises from insufficient permission checks in the functionality that lists tracked time entries, potentially allowing unauthorized information disclosure. The issue is categorized under CWE-284, indicating improper access control. No official patch or remediation level has been confirmed from the vendor advisory or patch links. The CVSS vector indicates the vulnerability is remotely exploitable without privileges or user interaction, impacting integrity but not confidentiality or availability.

An attacker without authentication or privileges could exploit this vulnerability to view tracked time entries that should be restricted. This could lead to unauthorized disclosure of project time tracking data, impacting data integrity by exposing or potentially manipulating time entry information. There is no indication of impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Gitea instances and monitor for unusual access patterns related to time tracking features. Avoid exposing the time tracking functionality to untrusted users.