Information Disclosure in Gitea <1.21.8 via User Login Time Exposure

Executive Summary

CVE-2025-68943 is an information leakage vulnerability in the Gitea platform's "/explore/users" page. It occurs because unsupported sort orders allowed users to be listed by sensitive fields such as their last login time or update time, unintentionally exposing user activity data and compromising user privacy. The vulnerability was fixed by restricting the allowed sort orders to only "create time" and "name," which do not reveal sensitive information. If an unsupported sort order is requested, the server now returns a 404 error, preventing exposure of sensitive user activity timestamps. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive user activity information, specifically users' last login times or update times, through the "/explore/users" page. Such information leakage can compromise user privacy and potentially aid attackers in profiling user behavior or timing, which might be leveraged in further attacks or social engineering. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by attempting to access the "/explore/users" page on your Gitea instance using unsupported sort order parameters such as "lastlogintime" or "updatetime". If the server returns user login times or does not respond with a 404 error for these unsupported sort orders, the system may be vulnerable. A simple command using curl could be: curl -i 'https://your-gitea-instance/explore/users?sort=lastlogintime' and check if sensitive user login time data is returned instead of a 404 Not Found response. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade your Gitea installation to version 1.21.8 or later, where the vulnerability is fixed by enforcing supported sort orders on the "/explore/users" page. This update restricts sorting to only "create time" and "name", preventing exposure of sensitive user activity data. If upgrading immediately is not possible, consider restricting access to the "/explore/users" page or implementing web application firewall rules to block requests with unsupported sort order parameters. [2, 3]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves inadvertent disclosure of users' last login times, which is sensitive user activity data. Such information leakage can potentially compromise user privacy, which may affect compliance with privacy regulations like GDPR that require protection of personal data. By exposing login times, the vulnerability could lead to unauthorized access to personal information, thereby increasing the risk of non-compliance with data protection standards. The fix restricts sort orders to prevent this leakage, helping to maintain compliance by safeguarding user activity data. [1]

Useful 0 Not Useful 0