Gitea
CVE-2025-69413
MEDIUM
GHSA-pc73-rj2c-wvf9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
AnalysisAI
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. [CVSS 5.3 MEDIUM]
Technical ContextAI
Affects Gitea. In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
More from same product – last 7 days
Stored cross-site scripting in Gitea 1.25.x affects the built-in 3D file viewer (Online3DViewer integration) where a cra
Authorization bypass in Gitea versions up to and including 1.26.1 allows any authenticated user with mere read access to
OAuth2 scope enforcement bypass in Gitea <= 1.26.1 allows any OAuth2 access token to perform write actions far beyond it
Authorization scope bypass in Gitea v1.26.1 and earlier allows authenticated users to use OAuth2/PAT Bearer tokens to pe
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Vendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today