CVE-2025-68945: Gitea Auth Bypass Vulnerability

CVE-2025-68945 Overview

CVE-2025-68945 is an information disclosure vulnerability in Gitea versions prior to 1.21.2. The flaw allows an anonymous, unauthenticated user to visit and view a private user's project pages. This breaks the expected access control boundary between public and private user content on the platform.

The issue is categorized under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor. It affects self-hosted Gitea instances where operators rely on project privacy settings to restrict visibility of code, issues, or planning boards belonging to individual users.

Critical Impact
Anonymous network attackers can enumerate and view private user projects on affected Gitea instances, leaking confidential project metadata and content.

Affected Products

Gitea versions prior to 1.21.2
Self-hosted Gitea Git service deployments
Gitea instances exposing user project features to anonymous visitors

Discovery Timeline

2025-12-26 - CVE-2025-68945 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68945

Vulnerability Analysis

Gitea supports user-level and organization-level projects that function as issue and task boards. These projects inherit visibility from their owning user or repository. When a user account or its associated project is marked private, only the owner and explicitly authorized collaborators should have read access.

In Gitea releases before 1.21.2, the project view handler failed to enforce the private visibility check for the owning user. An anonymous HTTP request to the project route was served the project content without validating whether the requester had permission to view the owner's private assets. The result is unauthorized disclosure of project metadata and any information rendered on the project board.

The fix landed in Gitea pull request #28423 and shipped in the Gitea 1.21.2 release. The Exploit Prediction Scoring System (EPSS) rates in-the-wild exploitation likelihood at 0.328%.

Root Cause

The root cause is a missing authorization check on the user project rendering path. The handler resolved the target project by identifier and returned its content without confirming the viewer's access to the private owner context. This is a classic broken access control pattern where the routing layer trusts object identifiers without validating the caller's authorization scope.

Attack Vector

Exploitation requires only network access to an affected Gitea instance. An attacker crafts a direct HTTP GET request to a known or guessable project URL belonging to a private user. No credentials, tokens, or user interaction are needed. The server responds with the private project's content, exposing information the owner intended to keep restricted.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the linked upstream pull request and release notes.

Detection Methods for CVE-2025-68945

Indicators of Compromise

Anonymous or unauthenticated HTTP GET requests to /-/projects/ or user project routes in Gitea access logs
Repeated project identifier enumeration patterns from a single source IP without an authenticated session cookie
Access log entries showing HTTP 200 responses for private user project URLs from unauthenticated sessions

Detection Strategies

Review Gitea reverse proxy and application logs for anonymous requests to project endpoints prior to patching
Compare project view request volumes against authenticated session counts to surface enumeration attempts
Alert on sequential or scripted access patterns targeting numeric project IDs from non-authenticated clients

Monitoring Recommendations

Forward Gitea access logs to a centralized logging or SIEM platform for retention and correlation
Baseline normal project-view traffic per user, then alert on spikes from anonymous sources
Track the running Gitea version across all self-hosted instances and flag any instance below 1.21.2

How to Mitigate CVE-2025-68945

Immediate Actions Required

Upgrade all Gitea instances to version 1.21.2 or later without delay
Audit historical access logs for anonymous requests against private user project URLs
Notify users of private projects that project metadata may have been exposed prior to patching

Patch Information

The fix is included in Gitea 1.21.2. See the Gitea 1.21.2 release announcement and the underlying pull request #28423 for the code change enforcing project visibility.

Workarounds

Restrict anonymous access to the Gitea instance at the reverse proxy by requiring authentication for /-/projects/ and user profile project routes
Disable the projects feature in app.ini if not required by your workflow until the patch is applied
Place the Gitea instance behind a VPN or IP allowlist to remove exposure to anonymous internet users

bash

# Configuration example: require login for repository and project browsing in app.ini
[service]
REQUIRE_SIGNIN_VIEW = true

[repository]
DISABLE_STARS = false
DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki