id: GO-ID-PENDING
modules:
- module: code.gitea.io/gitea
versions:
- fixed: 1.25.2
vulnerable_at: 1.25.1
summary: |-
Gitea's /api/v1/user endpoint has different responses for failed authentication
depending on whether a username exists in code.gitea.io/gitea
cves:
- CVE-2025-69413
ghsas:
- GHSA-pc73-rj2c-wvf9
references:
- advisory: https://github.com/advisories/GHSA-pc73-rj2c-wvf9
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-69413
- fix: https://github.com/go-gitea/gitea/pull/36002
- report: https://github.com/go-gitea/gitea/issues/35984
- web: https://blog.gitea.com/release-of-1.25.2
- web: https://github.com/go-gitea/gitea/releases/tag/v1.25.2
source:
id: GHSA-pc73-rj2c-wvf9
created: 2026-01-02T16:01:03.841632831Z
review_status: UNREVIEWED
Advisory GHSA-pc73-rj2c-wvf9 references a vulnerability in the following Go modules:
Description:
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.