CVE-2025-69413: Medium severity gitea/gitea vulnerability
Published Jan 1, 2026
·Updated
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
Affected Software
3 affected componentsFixes available
gitea/gitea<1.25.2
go/code.gitea.io/gitea<1.25.2
1.25.2
Gitea Gitea<1.25.2
Remediation
Patch Available
Event History
Jan 1, 2026
CVE Published
via MITRE·04:39 AM
Data Sourced
via MITRE·04:39 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 AM
Data Sourced
via GitHub·06:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-69413?
CVE-2025-69413 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2025-69413?
To fix CVE-2025-69413, upgrade Gitea to version 1.25.2 or later.
3
What issue does CVE-2025-69413 present?
CVE-2025-69413 allows attackers to infer valid usernames based on different responses for failed authentication.
4
Which versions of Gitea are affected by CVE-2025-69413?
Gitea versions before 1.25.2 are affected by CVE-2025-69413.
5
Is CVE-2025-69413 a remote or local vulnerability?
CVE-2025-69413 is a remote vulnerability that can be exploited by an attacker over the network.