User Login Time Disclosure in Gitea
CVE-2025-68943

5.3MEDIUM

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
26 December 2025

What is CVE-2025-68943?

In Gitea versions prior to 1.21.8, a vulnerability exists that can lead to the unintended disclosure of users' login times. This occurs through the exploitation of the sort order on the last login time within the explore/users feature. As a result, unauthorized users may gain insights into user activity, posing a potential privacy risk. It is crucial for users to upgrade to the latest version to mitigate this security concern.

Affected Version(s)

Gitea 0 < 1.21.8

References

https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1...
https://github.com/go-gitea/gitea/releases/tag/v1.21.8
https://github.com/go-gitea/gitea/pull/29430

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68943 : User Login Time Disclosure in Gitea