CVE-2025-68938: 
NixOS vulnerability analysis and mitigation

CVE-2025-68938 is an incorrect authorization vulnerability in Gitea that mishandles permission checks for the deletion of project releases. It affects all Gitea versions prior to 1.25.2 and was published on December 26, 2025. The flaw allows an authenticated user with low privileges to delete releases they should not have permission to remove. The CVSS v3.1 base score is 4.3 (Moderate) per the GitHub Advisory Database, though some sources report 5.3 (Medium) under a slightly different vector (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization). Specifically, in services/release/release.go, the DeleteReleaseByID function incorrectly used rel.PublisherID (the original release publisher's ID) instead of doer.ID (the currently acting user's ID) when calling git_model.IsUserAllowedToControlTag to check tag protection rules (Gitea PR #36002). This means the authorization check was performed against the wrong user identity, potentially allowing a low-privileged authenticated user to bypass tag protection controls and delete releases. Exploitation requires network access and a valid low-privilege account on the Gitea instance (Github Advisory).

Successful exploitation allows an authenticated attacker with minimal privileges to delete project releases, including those protected by tag rules. This results in a low availability impact — specifically, loss of release artifacts, disruption of software distribution pipelines, and corruption of project release history. There is no confidentiality or integrity impact beyond the deletion itself, and lateral movement potential is limited (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019–0.034%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication with at least a low-privilege account, reducing the attack surface compared to unauthenticated vulnerabilities (Github Advisory, Feedly).

1. Reconnaissance: Identify a Gitea instance running a version prior to 1.25.2 using version disclosure in the web UI footer or API endpoint /api/v1/version.
2. Obtain low-privilege access: Authenticate to the Gitea instance with any valid user account, including accounts with only read or minimal write access to a repository.
3. Identify target release: Browse or query the repository's releases via the API (GET /api/v1/repos/{owner}/{repo}/releases) to identify a release to delete.
4. Send delete request: Issue a DELETE /api/v1/repos/{owner}/{repo}/releases/{id} API request authenticated as the low-privilege user. Due to the incorrect authorization check using the publisher's ID instead of the acting user's ID, the permission check may pass incorrectly.
5. Release deleted: The targeted release is removed, potentially bypassing tag protection rules that should have prevented the action (Gitea PR #36002).

• Network: Unexpected DELETE requests to /api/v1/repos/{owner}/{repo}/releases/{id} from user accounts that do not have release management permissions.
• Logs: Gitea access logs showing release deletion events (DELETE /releases/) attributed to low-privilege or unexpected user accounts; audit log entries for release deletions by non-maintainer users.
• Application: Missing releases or tags in repositories where no authorized deletion was performed; discrepancies between expected release history and current state.

Upgrade Gitea to version 1.25.2 or later, which contains the fix for this vulnerability as part of the security release addressing "various permission & login related bugs" (Gitea v1.25.2 Release). As a workaround prior to patching, restrict release deletion permissions by enforcing tag protection rules and limiting repository write access to trusted users only. Regularly audit user permissions and monitor release management activity for unauthorized deletions (Github Advisory).

The vulnerability received limited public attention, with coverage primarily from automated vulnerability tracking services and security feeds. A brief post appeared on Bluesky via a CVE tracking account, and the issue was noted on security aggregators such as VulnDB and CVEFeed. No significant researcher commentary or vendor statements beyond the Gitea release notes and GitHub advisory have been identified.