CVE-2025-68941
📋 TL;DR
Gitea versions before 1.22.3 contain an authorization bypass vulnerability where API tokens with scope limited to public resources can improperly access private resources. This affects all Gitea instances running vulnerable versions where users have API tokens with public-only scopes. The vulnerability allows unauthorized access to private repositories or resources.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
An attacker with a public-scoped API token could access sensitive private repositories, source code, or configuration files, potentially leading to intellectual property theft or credential exposure.
Likely Case
Users with legitimate public-scoped API tokens inadvertently gain access to private resources they shouldn't see, violating access controls and potentially exposing sensitive information.
If Mitigated
With proper network segmentation and API token auditing, impact is limited to unauthorized access within the scope of the compromised token's permissions.
🎯 Exploit Status
Exploitation requires a valid API token with public-only scope. The vulnerability is in authorization logic, making exploitation straightforward once an attacker obtains such a token.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.3
Vendor Advisory: https://blog.gitea.com/release-of-1.22.3/
Restart Required: Yes
Instructions:
1. Backup your Gitea instance and database. 2. Download Gitea 1.22.3 from official releases. 3. Stop Gitea service. 4. Replace the Gitea binary with the new version. 5. Restart Gitea service. 6. Verify the version is now 1.22.3.
🔧 Temporary Workarounds
Revoke all public-scoped API tokens
allTemporarily mitigate by revoking all API tokens with public-only scopes until patching can be completed.
# Navigate to each user's settings and revoke tokens with public-only scope
# Or use database query: UPDATE access_token SET is_active = false WHERE scope = 'public'
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Gitea API endpoints
- Regularly audit and rotate all API tokens, especially those with public-only scopes
🔍 How to Verify
Check if Vulnerable:
Check Gitea version via web interface admin panel or run: ./gitea --versionCheck Version:
./gitea --versionVerify Fix Applied:
After patching, verify version is 1.22.3 or higher and test that API tokens with public-only scope cannot access private resources.📡 Detection & Monitoring
Log Indicators:
- Unusual API access patterns from tokens with public scope
- Access denied errors followed by successful access to private resources
Network Indicators:
- API requests to private repository endpoints from tokens with public scope
SIEM Query:
source="gitea.log" AND ("scope=public" AND "private" AND status=200)