CVE-2025-68943: 
NixOS vulnerability analysis and mitigation

CVE-2025-68943 is an information disclosure vulnerability in Gitea that inadvertently exposes users' last login times by permitting unsupported sort orders (e.g., lastlogintime) on the /explore/users page. It affects all Gitea versions before 1.21.8 and was published on December 26, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere): Gitea's /explore/users page did not validate or restrict the sort query parameter, allowing callers to specify internal sort orders such as lastlogintime or updatetime that were never intended to be publicly accessible. An unauthenticated remote attacker can craft a simple HTTP GET request to /explore/users?sort=lastlogintime to retrieve a user listing ordered by last login time, effectively inferring when individual accounts were most recently active. The fix, implemented in pull request #29430, restricts the page to a whitelist of supported sort orders (newest, oldest, alphabetically, etc.) and returns a 404 for any unsupported value (Gitea PR #29430, Github Advisory).

Successful exploitation allows any unauthenticated network attacker to infer the last login times of all registered users on a Gitea instance, leaking user activity patterns without authorization. While there is no integrity or availability impact, the confidentiality exposure could assist attackers in identifying active accounts for targeted phishing, credential stuffing, or social engineering campaigns. The scope is limited to the affected Gitea instance, but on publicly accessible instances the information is available to anyone on the internet (Github Advisory, Gitea PR #29430).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of near-term exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication, no special privileges, and no user interaction, making it trivially easy to attempt, but the low-severity information disclosure limits attacker motivation.

1. Reconnaissance: Identify a publicly accessible Gitea instance running a version prior to 1.21.8 using search engines, Shodan, or direct browsing.
2. Craft the request: Send an unauthenticated HTTP GET request to the explore users endpoint with the unsupported sort parameter, e.g., GET /explore/users?sort=lastlogintime.
3. Observe the response: The server returns a list of registered users ordered by their last login time, revealing which accounts are most recently active.
4. Enumerate further: Iterate through pages (e.g., ?sort=lastlogintime&page=2) to collect activity data for all registered users on the instance.
5. Use gathered intelligence: Leverage the inferred activity patterns to identify active accounts for targeted attacks such as phishing or credential stuffing (Gitea PR #29430, Github Advisory).

• Network: HTTP GET requests to /explore/users with query parameters sort=lastlogintime or sort=updatetime from external or unexpected IP addresses.
• Logs: Web server or application access logs showing repeated or automated requests to /explore/users?sort=lastlogintime or /explore/users?sort=updatetime, potentially with sequential page parameters indicating enumeration.
• Logs: Unusual volume of requests to the /explore/users endpoint from a single IP or user agent, suggesting automated scraping of user activity data.

Upgrade Gitea to version 1.21.8 or later, which restricts the /explore/users page to a whitelist of supported sort orders and eliminates the information disclosure (Gitea v1.21.8 Release). If an immediate upgrade is not possible, administrators can mitigate exposure by restricting public access to the /explore/users endpoint via a reverse proxy or firewall rule, or by disabling the explore page for unauthenticated users in Gitea's configuration (REQUIRE_SIGNIN_VIEW = true in app.ini). Upgrading to the patched version is the recommended long-term solution (Github Advisory).

The vulnerability was originally reported by community member inferenceus and acknowledged by Gitea contributor wxiaoguang, who implemented the fix in PR #29430. Discussion in the pull request included minor debate among maintainers about whether unsupported sort parameters should return a 404 or be silently ignored, reflecting standard API design considerations. No significant media coverage or broader security community commentary has been identified beyond the standard advisory publications (Gitea PR #29430).