Gitea CVE-2025-68943

Exploitation requires that the Gitea instance expose the /explore/users (or /explore/organizations) listing to the requester - on public or internally-reachable instances this is accessible to unauthenticated visitors by default. The specific trigger is supplying the sort query parameter with value lastlogin or reverselastlogin (and related leaking orders such as leastupdate/reverseleastupdate) to the explore endpoint on any Gitea version before 1.21.8. Limiting factors: if the explore pages are disabled or restricted to authenticated users, or the instance requires login to browse, the unauthenticated path is cut off; impact is also limited to disclosing user last-login timestamps rather than any credential or content access.

This is a genuine but low-severity information-disclosure issue, correctly rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - network-reachable, low complexity, no privileges or user interaction, with only limited confidentiality impact (C:L) and no integrity or availability impact. The signals are consistent rather than conflicting: EPSS is low at 0.36% (27th percentile), there is no CISA KEV listing, and no public exploit code was identified, all of which align with a minor privacy leak rather than a high-priority intrusion vector. The CVSS network/unauthenticated vector is corroborated by the source code: an anonymous HTTP GET to /explore/users?sort=lastlogin exposes login timestamps, so the AV:N/PR:N rating is well-founded. The 'exploit' yields only metadata (when users last logged in), not account compromise, code execution, or credential theft - so despite the trivially-easy exploitation, real-world risk is low and this should be patched on a routine schedule rather than as an emergency. The main value of the disclosed data is reconnaissance (identifying active vs. dormant accounts for targeted follow-on attacks).

An unauthenticated attacker visits a public Gitea instance and requests the explore/users listing with the sort parameter set to lastlogin (e.g. /explore/users?sort=lastlogin), causing the server to order and thereby reveal users' last-login times. The attacker harvests this activity metadata to profile which accounts are active or dormant for targeted phishing or password-guessing. No public exploit code is required - the attack is a single crafted query string against the standard web UI.