id: GO-ID-PENDING
modules:
- module: code.gitea.io/gitea
versions:
- fixed: 1.22.3
vulnerable_at: 1.22.2
summary: |-
Gitea mishandles access to a private resource upon receiving an API token with
scope limited to public resources in code.gitea.io/gitea
cves:
- CVE-2025-68941
ghsas:
- GHSA-xfq3-qj7j-4565
references:
- advisory: https://github.com/advisories/GHSA-xfq3-qj7j-4565
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-68941
- fix: https://github.com/go-gitea/gitea/pull/32218
- web: https://blog.gitea.com/release-of-1.22.3
- web: https://github.com/go-gitea/gitea/releases/tag/v1.22.3
source:
id: GHSA-xfq3-qj7j-4565
created: 2025-12-26T20:01:10.404720119Z
review_status: UNREVIEWED
Advisory GHSA-xfq3-qj7j-4565 references a vulnerability in the following Go modules:
Description:
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.