CVE-2025-68943
Information Disclosure in Gitea <1.21.8 via User Login Time Exposure
Publication date: 2025-12-26
Last updated on: 2025-12-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitea | gitea | 1.21.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68943 is an information leakage vulnerability in the Gitea platform's "/explore/users" page. It occurs because unsupported sort orders allowed users to be listed by sensitive fields such as their last login time or update time, unintentionally exposing user activity data and compromising user privacy. The vulnerability was fixed by restricting the allowed sort orders to only "create time" and "name," which do not reveal sensitive information. If an unsupported sort order is requested, the server now returns a 404 error, preventing exposure of sensitive user activity timestamps. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by exposing sensitive user activity information, specifically users' last login times or update times, through the "/explore/users" page. Such information leakage can compromise user privacy and potentially aid attackers in profiling user behavior or timing, which might be leveraged in further attacks or social engineering. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting to access the "/explore/users" page on your Gitea instance using unsupported sort order parameters such as "lastlogintime" or "updatetime". If the server returns user login times or does not respond with a 404 error for these unsupported sort orders, the system may be vulnerable. A simple command using curl could be: curl -i 'https://your-gitea-instance/explore/users?sort=lastlogintime' and check if sensitive user login time data is returned instead of a 404 Not Found response. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade your Gitea installation to version 1.21.8 or later, where the vulnerability is fixed by enforcing supported sort orders on the "/explore/users" page. This update restricts sorting to only "create time" and "name", preventing exposure of sensitive user activity data. If upgrading immediately is not possible, consider restricting access to the "/explore/users" page or implementing web application firewall rules to block requests with unsupported sort order parameters. [2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves inadvertent disclosure of users' last login times, which is sensitive user activity data. Such information leakage can potentially compromise user privacy, which may affect compliance with privacy regulations like GDPR that require protection of personal data. By exposing login times, the vulnerability could lead to unauthorized access to personal information, thereby increasing the risk of non-compliance with data protection standards. The fix restricts sort orders to prevent this leakage, helping to maintain compliance by safeguarding user activity data. [1]