CVE-2025-68940Low· 3.1▾ SunlitIn Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
gitea < 1.22.5Upgrade past the affected range:
gitea 1.22.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68941Medium· 4.9Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
CVE-2025-68938Medium· 4.3Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2025-68946Medium· 5.4In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVE-2025-68944Medium· 5.0Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVE-2025-68945Medium· 5.8In Gitea before 1.21.2, an anonymous user can visit a private user's project.
CVE-2025-68942Medium· 5.4Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.