{"id":"EUVD-2025-205408","enisaUuid":"a09336e3-6d98-3262-a8b9-71e607d39628","description":"Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.","datePublished":"Dec 26, 2025, 2:31:59 AM","dateUpdated":"Dec 26, 2025, 7:31:33 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://blog.gitea.com/release-of-1.22.3/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.3\nhttps://github.com/go-gitea/gitea/pull/32218\n","aliases":"CVE-2025-68941\nGHSA-xfq3-qj7j-4565\n","assigner":"mitre","epss":0.26,"enisaIdProduct":[{"id":"14bf1f99-e914-3988-a0e0-c6ad58fb8e55","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.22.3"}],"enisaIdVendor":[{"id":"2d0a7569-6012-3a03-b7af-f2130de89b0d","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"2307a826-fac1-3470-aa00-0314f479016f","vulnerability":{"id":"CVE-2025-68941","description":"Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.","datePublished":"Dec 26, 2025, 2:31:59 AM","dateUpdated":"Dec 26, 2025, 7:31:33 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","references":"https://blog.gitea.com/release-of-1.22.3/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.3\nhttps://github.com/go-gitea/gitea/pull/32218\n","enisa_id":"EUVD-2025-205408\n","assigner":"mitre","epss":0.26,"dataProcessed":"Nov 8, 2026, 7:13:21 AM","vulnerabilityProduct":[{"id":"c1ea97a8-eca2-3702-b493-0b3780b5da70","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.22.3"}],"vulnerabilityVendor":[{"id":"ba9b5299-c527-3881-ace7-d4ad8e658747","vendor":{"name":"Gitea"}}]}},{"id":"368f185d-b0b6-32f6-8a39-ce98c6b4a550","vulnerability":{"id":"GHSA-xfq3-qj7j-4565","description":"Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources","datePublished":"Dec 26, 2025, 3:30:15 AM","dateUpdated":"Dec 26, 2025, 7:12:54 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-68941\nhttps://github.com/go-gitea/gitea/pull/32218\nhttps://blog.gitea.com/release-of-1.22.3\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.3\n","enisa_id":"EUVD-2025-205408\n","aliases":"GHSA-xfq3-qj7j-4565\nCVE-2025-68941\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}