CVE-2025-68941: Medium severity gitea vulnerability
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/code.gitea.io/giteato a version that resolves this vulnerability.Fixed in 1.22.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68941?
CVE-2025-68941 has been assigned a medium severity rating due to the potential for unauthorized access to private resources.
How do I fix CVE-2025-68941?
To fix CVE-2025-68941, upgrade Gitea to version 1.22.3 or later immediately.
What does CVE-2025-68941 affect?
CVE-2025-68941 affects versions of Gitea prior to 1.22.3, specifically concerning access controls for API tokens.
Is CVE-2025-68941 a risk for all Gitea users?
Yes, CVE-2025-68941 poses a risk to all Gitea users operating versions below 1.22.3.
Are there any workarounds for CVE-2025-68941 before upgrading?
No specific workarounds are recommended for CVE-2025-68941; upgrading to the patched version is the only solution.