{"id":"EUVD-2025-205415","enisaUuid":"93a8a468-abce-3174-aa08-c7250e870bd9","description":"Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.","datePublished":"Dec 26, 2025, 3:37:28 AM","dateUpdated":"Dec 26, 2025, 7:28:23 PM","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","references":"https://blog.gitea.com/release-of-1.22.2/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.2\nhttps://github.com/go-gitea/gitea/pull/31967\n","aliases":"CVE-2025-68944\nGHSA-f85h-c7m6-cfpm\n","assigner":"mitre","epss":0.28,"enisaIdProduct":[{"id":"f3aa25b0-9ed2-3058-9821-625802dffcaf","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.22.2"}],"enisaIdVendor":[{"id":"a85588cc-e657-36d7-b2c5-78516a5da7c0","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"8eed680d-7c13-39ce-88af-44fc19eedf54","vulnerability":{"id":"CVE-2025-68944","description":"Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.","datePublished":"Dec 26, 2025, 3:37:28 AM","dateUpdated":"Dec 26, 2025, 7:28:23 PM","status":"PUBLISHED","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","references":"https://blog.gitea.com/release-of-1.22.2/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.2\nhttps://github.com/go-gitea/gitea/pull/31967\n","enisa_id":"EUVD-2025-205415\n","assigner":"mitre","epss":0.28,"dataProcessed":"Nov 8, 2026, 7:13:21 AM","vulnerabilityProduct":[{"id":"39cb4f7a-193b-3d05-a1a4-a1c30b38e4b5","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.22.2"}],"vulnerabilityVendor":[{"id":"69aea2f1-10c4-3ac9-9c8e-473463f17b2b","vendor":{"name":"Gitea"}}]}},{"id":"f3ae8de9-236a-3f56-b849-83b491ccea2c","vulnerability":{"id":"GHSA-f85h-c7m6-cfpm","description":"Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries","datePublished":"Dec 26, 2025, 6:30:27 AM","dateUpdated":"Dec 26, 2025, 7:30:16 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-68944\nhttps://github.com/go-gitea/gitea/pull/31967\nhttps://blog.gitea.com/release-of-1.22.2\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.22.2\n","enisa_id":"EUVD-2025-205415\n","aliases":"CVE-2025-68944\nGHSA-f85h-c7m6-cfpm\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}