CVE-2025-68941Medium· 4.9▾ SunlitGitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
gitea < 1.22.3Upgrade past the affected range:
gitea 1.22.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73126Medium· 4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request
CVE-2025-68938Medium· 4.3Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2025-68940Low· 3.1In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVE-2026-89182Medium· 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push
CVE-2026-97208Medium· 4.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces
CVE-2026-86684High· 7.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths