medium5.0
CVE-2025-68944
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries
Impact
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.22.2 | 1.22.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitea | Gitea | before 1.22.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.gitea.com/release-of-1.22.2/
- https://github.com/go-gitea/gitea/pull/31967
- https://github.com/go-gitea/gitea/releases/tag/v1.22.2
- https://github.com/advisories/GHSA-f85h-c7m6-cfpm
- https://nvd.nist.gov/vuln/detail/CVE-2025-68944
- https://blog.gitea.com/release-of-1.22.2