CVE-2025-69413Medium· 5.3▾ SunlitIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
gitea < 1.25.2Upgrade past the affected range:
gitea 1.25.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68938Medium· 4.3Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2026-73539NoneGitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting
CVE-2026-73126Medium· 4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request
CVE-2026-70407Medium· 4.3Gitea's organization-list API does not enforce the read:organization token scope
CVE-2026-68964Medium· 4.3Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents
CVE-2026-68957Medium· 4.3Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners