In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-69413 · Microsoft / collected KEV context

EUVD-2025-206132

GHSA-pc73-rj2c-wvf9

BIT-gitea-2025-69413

GO-2026-4274

cve-program · CVE-2025-69413

• https://blog.gitea.com/release-of-1.25.2/
• https://github.com/go-gitea/gitea/releases/tag/v1.25.2
• https://github.com/go-gitea/gitea/issues/35984
• https://github.com/go-gitea/gitea/pull/36002

euvd · EUVD-2025-206132

• https://blog.gitea.com/release-of-1.25.2/
• https://github.com/go-gitea/gitea/releases/tag/v1.25.2
• https://github.com/go-gitea/gitea/issues/35984
• https://github.com/go-gitea/gitea/pull/36002

nvd · CVE-2025-69413

• https://blog.gitea.com/release-of-1.25.2/
• https://github.com/go-gitea/gitea/issues/35984
• https://github.com/go-gitea/gitea/pull/36002
• https://github.com/go-gitea/gitea/releases/tag/v1.25.2

osv · GHSA-pc73-rj2c-wvf9

• https://nvd.nist.gov/vuln/detail/CVE-2025-69413
• https://github.com/go-gitea/gitea/issues/35984
• https://github.com/go-gitea/gitea/pull/36002
• https://blog.gitea.com/release-of-1.25.2
• https://github.com/go-gitea/gitea
• https://github.com/go-gitea/gitea/releases/tag/v1.25.2

osv · GO-2026-4274

• https://github.com/advisories/GHSA-pc73-rj2c-wvf9
• https://nvd.nist.gov/vuln/detail/CVE-2025-69413
• https://blog.gitea.com/release-of-1.25.2
• https://github.com/go-gitea/gitea/issues/35984
• https://github.com/go-gitea/gitea/pull/36002
• https://github.com/go-gitea/gitea/releases/tag/v1.25.2

No related operational record is retained in the current change model.