CVE-2025-69413Medium· 5.3▾ TwilightPoC availableIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Exploit / PoC code exists
0.4% → 0.4%
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
gitea < 1.25.2Upgrade past the affected range:
gitea 1.25.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68938Medium· 4.3Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2026-89182Medium· 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push
CVE-2026-60004Critical· 9.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-34966High· 7.6Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default …
CVE-2026-73539High· 7.5Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting
CVE-2026-73126Medium· 4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request