Gitea versions prior to 1.25.5 access tracked‑time entries by time identifier alone, without tying the lookup to the issue described in the request URL. This allows a user who can delete a tracked‑time entry for one issue to target and delete any entry whose time ID is known, regardless of the issue it belongs to. The direct effect is loss of time‑tracking data. The weakness falls under CWE‑639, representing an authorization bypass.

All releases of the Gitea Open Source Git Server older than version 1.25.5 are affected, spanning every public download of the software that has not been patched. The issue applies independently of the deployment environment; any instance running a pre‑1.25.5 build is susceptible.

Based on the description, it is inferred that an attacker who can delete a tracked‑time entry must first know a valid time ID belonging to an issue they are not authorized for. By sending a deletion request for that ID, the request bypasses normal authorization checks, allowing deletion of any tracked‑time entry regardless of the issue referenced. The exact method for acquiring a known time ID is not detailed, so we assume it can be deduced from existing entries or guessed. The CVSS score of 5.3 indicates moderate severity, the EPSS score is below 1 %, and the CVE is not listed in the KEV catalog, suggesting a low likelihood of exploitation in the wild. The vulnerability thus results in loss of tracked‑time data.