CVE-2025-68944Medium· 5.0▾ SunlitGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
gitea < 1.22.2Upgrade past the affected range:
gitea 1.22.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68942Medium· 5.4Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
CVE-2026-94205Critical· 9.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author
CVE-2025-69413Medium· 5.3In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
CVE-2026-73539High· 7.5Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting
CVE-2026-73126Medium· 4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request
CVE-2026-70407Medium· 4.3Gitea's organization-list API does not enforce the read:organization token scope