CVE-2025-69413
BaseFortify
Publication date: 2026-01-01
Last updated on: 2026-01-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitea | gitea | to 1.25.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a user enumeration issue in Gitea version 1.25.1 where the /api/v1/user endpoint returns different error messages depending on whether a username exists. If the username does not exist, the response is "user does not exist." If the username exists but the password is wrong, the response is "user's password is invalid." This difference allows attackers to determine valid usernames on the system. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to enumerate valid usernames on the system, which can be used as a first step in targeted attacks such as password guessing, phishing, or social engineering. Knowing valid usernames can increase the risk of unauthorized access attempts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to authenticate with different usernames and observing the error messages returned by the /api/v1/user endpoint. Specifically, sending login requests with various usernames and checking if the error messages differ between "user does not exist" and "user's password is invalid" indicates the presence of the vulnerability. For example, using curl commands to POST login attempts and inspecting the response messages can help detect this issue. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Gitea to version 1.25.2 or later, where this user enumeration vulnerability has been fixed by standardizing the authentication error responses to prevent revealing username existence. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows user enumeration by revealing whether a username exists through different error messages during authentication attempts. Such information disclosure can increase the risk of targeted attacks on user accounts, potentially impacting the confidentiality of user data. While the provided resources do not explicitly discuss compliance with standards like GDPR or HIPAA, user enumeration vulnerabilities can be considered a risk factor for data protection and privacy requirements under these regulations, as they may facilitate unauthorized access attempts or profiling of users. [1]