CVE-2025-68941: 
NixOS vulnerability analysis and mitigation

CVE-2025-68941 is an incorrect authorization vulnerability in Gitea that causes the platform to mishandle access to private resources when an API token scoped exclusively to public resources is presented. All Gitea versions before 1.22.3 are affected. The CVE was published on December 26, 2025, with the fix merged on October 9, 2024 and released in Gitea v1.22.3. NVD assigns a CVSS v3.1 base score of 5.3 (Medium), while the CNA (MITRE) scores it 4.9 (Medium) (Github Advisory, Gitea Release).

The root cause is CWE-863 (Incorrect Authorization): Gitea's API token scope enforcement logic fails to correctly restrict access when a token is configured with a public-only scope, inadvertently permitting access to private resources (Github Advisory). An authenticated attacker who possesses a valid API token — even one explicitly scoped to public resources only — can send API requests that bypass the intended scope boundary and retrieve private repository data. The fix was implemented in pull request #32218, which corrected the token scope validation logic in the API middleware (Gitea PR). No special configuration or elevated privileges beyond a valid (public-scoped) API token are required to trigger the flaw.

Successful exploitation allows an authenticated attacker to read private repository content and potentially modify resources they should not have access to, breaching confidentiality and integrity of private Gitea repositories (Github Advisory, Red Hat Bugzilla). Availability is not impacted. The scope change noted in the MITRE CVSS vector indicates that the vulnerable component (the API token scope enforcement) can affect resources beyond its intended security boundary, meaning private repositories belonging to any user or organization on the instance could be exposed to a token holder who should only have public access.

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-68941. The EPSS score is approximately 0.025% (1st percentile), indicating a very low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already possess a valid Gitea API token (even a public-scoped one), which limits the attack surface to authenticated users or those who have obtained a token through other means.

1. Obtain a public-scoped API token: Register or log in to a vulnerable Gitea instance (version < 1.22.3) and generate an API token with scope restricted to public resources only (e.g., via User Settings → Applications → Generate Token, selecting only public scopes).
2. Identify private repositories: Use the Gitea API with the public-scoped token to enumerate repositories, including those that should be inaccessible (e.g., GET /api/v1/repos/search?token=<public_token>&limit=50).
3. Access private resource: Send an authenticated API request targeting a known or discovered private repository using the public-scoped token (e.g., GET /api/v1/repos/{owner}/{private-repo} or GET /api/v1/repos/{owner}/{private-repo}/contents/{path} with the Authorization: token <public_token> header).
4. Exfiltrate data: Due to the authorization bypass, the server returns private repository content, allowing the attacker to read source code, configuration files, or other sensitive data that should be restricted (Gitea PR, Github Advisory).

• Network: Unusual API requests to private repository endpoints (/api/v1/repos/{owner}/{private-repo}/*) originating from tokens or users that should only have public access; high volume of API enumeration requests (/api/v1/repos/search) from a single token.
• Logs: Gitea access logs showing successful HTTP 200 responses to private repository API endpoints for tokens explicitly scoped to public resources; repeated API calls to /api/v1/repos/ with the same token across multiple private repositories in a short timeframe.
• Application: API tokens with public-only scope appearing in audit logs alongside access events for private repositories — cross-reference token scope settings against resource access logs in Gitea's admin panel.

Upgrade Gitea to version 1.22.3 or later, which contains the fix for the token scope enforcement bug (pull request #32218) (Gitea Release). No official configuration-based workaround has been published; upgrading is the only recommended remediation. As an interim measure, administrators may consider auditing existing API tokens and revoking any public-scoped tokens that do not need to exist, and reviewing access logs for anomalous private resource access.

The vulnerability received moderate attention from the security community upon disclosure in late December 2025, with coverage appearing on vulnerability aggregators such as VulDB, Vulners, and CIRCL's vulnerability database. Red Hat tracked the issue via Bugzilla (Bug 2425457) and published a security advisory (Red Hat Advisory). A brief write-up was published by Infinitsec characterizing it as a privilege escalation vulnerability. No significant vendor statements beyond the release notes or notable researcher commentary have been identified.