id: GO-ID-PENDING
modules:
- module: code.gitea.io/gitea
versions:
- fixed: 1.22.2
vulnerable_at: 1.22.1
summary: |-
Gitea sometimes mishandles propagation of token scope for access control within
one of its own package registries in code.gitea.io/gitea
cves:
- CVE-2025-68944
ghsas:
- GHSA-f85h-c7m6-cfpm
references:
- advisory: https://github.com/advisories/GHSA-f85h-c7m6-cfpm
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-68944
- fix: https://github.com/go-gitea/gitea/pull/31967
- web: https://blog.gitea.com/release-of-1.22.2
- web: https://github.com/go-gitea/gitea/releases/tag/v1.22.2
source:
id: GHSA-f85h-c7m6-cfpm
created: 2025-12-26T20:01:06.122232044Z
review_status: UNREVIEWED
Advisory GHSA-f85h-c7m6-cfpm references a vulnerability in the following Go modules:
Description:
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.