Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-68943 · Microsoft / collected KEV context

EUVD-2025-205416

GHSA-jhx5-4vr4-f327

BIT-gitea-2025-68943

GO-2025-4266

cve-program · CVE-2025-68943

• https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10/
• https://github.com/go-gitea/gitea/releases/tag/v1.21.8
• https://github.com/go-gitea/gitea/pull/29430

euvd · EUVD-2025-205416

• https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10/
• https://github.com/go-gitea/gitea/releases/tag/v1.21.8
• https://github.com/go-gitea/gitea/pull/29430

nvd · CVE-2025-68943

• https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10/
• https://github.com/go-gitea/gitea/pull/29430
• https://github.com/go-gitea/gitea/releases/tag/v1.21.8

osv · GHSA-jhx5-4vr4-f327

• https://nvd.nist.gov/vuln/detail/CVE-2025-68943
• https://github.com/go-gitea/gitea/pull/29430
• https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10
• https://github.com/go-gitea/gitea
• https://github.com/go-gitea/gitea/releases/tag/v1.21.8

osv · GO-2025-4266

• https://github.com/advisories/GHSA-jhx5-4vr4-f327
• https://nvd.nist.gov/vuln/detail/CVE-2025-68943
• https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10
• https://github.com/go-gitea/gitea/pull/29430
• https://github.com/go-gitea/gitea/releases/tag/v1.21.8

No related operational record is retained in the current change model.