Gitea Stopwatch API Repository Access Vulnerability

A vulnerability exists in Gitea's stopwatch API, where repository access permissions are not properly re-validated. This issue allows users to view issue titles and repository names from private repositories even after their access has been revoked, through previously started stopwatches.

Impact

Exploitation of this vulnerability could lead to unauthorized visibility of private repository details, such as issue titles and repository names.

Reproduction

To reproduce this vulnerability, first access a private repository and start a stopwatch. Afterward, revoke the access to the repository. Despite the access being revoked, the issue titles and repository names can still be viewed through the stopwatch API, indicating that the access permissions were not properly updated.

Remediation

Users can upgrade to Gitea version 1.25.4, where this vulnerability has been addressed.