{"id":"EUVD-2026-41623","enisaUuid":"8572bd78-cff5-3cf0-84fc-9963bd797442","description":"Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.","datePublished":"Jul 3, 2026, 8:19:32 PM","dateUpdated":"Jul 7, 2026, 4:59:52 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58\nhttps://github.com/go-gitea/gitea/pull/37118\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","aliases":"CVE-2026-25714\nGHSA-8629-vc8r-5p58\n","assigner":"Gitea","epss":0.39,"enisaIdProduct":[{"id":"eff37fa6-30f3-388c-b96c-20d4950c222c","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"enisaIdVendor":[{"id":"3bf26484-3672-3bd2-90f5-5cdbef87d868","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"198cf1e9-29f8-3b3f-870f-1e0a0bee25e6","vulnerability":{"id":"GHSA-8629-vc8r-5p58","description":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","datePublished":"Jun 16, 2026, 11:41:31 PM","dateUpdated":"Jun 16, 2026, 11:41:31 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-41623\n","aliases":"CVE-2026-25714\nGHSA-8629-vc8r-5p58\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6707929d-8363-34eb-a73b-eee44f7f5994","vulnerability":{"id":"CVE-2026-25714","description":"Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.","datePublished":"Jul 3, 2026, 8:19:32 PM","dateUpdated":"Jul 7, 2026, 4:59:52 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58\nhttps://github.com/go-gitea/gitea/pull/37118\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","enisa_id":"EUVD-2026-41623\n","assigner":"Gitea","epss":0.39,"dataProcessed":"Nov 2, 2026, 7:13:32 AM","vulnerabilityProduct":[{"id":"dda2b9ea-e077-346e-abf7-0abec2165582","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"vulnerabilityVendor":[{"id":"a66dc561-b6ab-3f24-811e-d8a3e207ad83","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}