Cloudanix VulnDB

CVE-2025-68941

Medium · 4.9

Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

CVSS

4.9

EPSS

0.3%

Published

Dec 26, 2025

CISA due date

—

The record

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

Affected packages

Ecosystem Package Introduced Fixed
Go code.gitea.io/gitea 0 1.22.3
Bitnami gitea 0 1.22.3
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1

Related vulnerabilities