CVE-2025-68944: 
NixOS vulnerability analysis and mitigation

CVE-2025-68944 is an access control bypass vulnerability in Gitea's package registry that stems from improper propagation of token scope, classified as a Confused Deputy problem (CWE-441). It affects all Gitea versions before 1.22.2 and was publicly disclosed on December 26, 2025. The vulnerability allows authenticated users to perform package upload operations beyond their intended token permissions in affected registries (NuGet, Conan, and container registries). It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, or 5.0 (Moderate) per the GitHub Advisory (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-441 (Unintended Proxy or Intermediary / 'Confused Deputy'), where Gitea fails to consistently enforce token scope restrictions during package upload operations in its NuGet, Conan, and container package registries. When a token with read-only package permissions is used, the scope is not correctly propagated through the access control logic, allowing the token to be treated as having broader write permissions than intended. The fix was implemented in pull request #31967, which corrected the scope-checking logic and added a dedicated function to avoid duplicated permission-checking code (Gitea PR #31967, Github Advisory).

Successful exploitation allows an authenticated attacker with a read-scoped token to upload or modify packages in Gitea's NuGet, Conan, or container registries beyond their authorized access level, compromising the integrity of those package registries. There is no confidentiality or availability impact — the vulnerability is limited to unauthorized write operations on package resources. In supply chain contexts, this could enable an attacker to inject malicious packages into registries that other users or CI/CD pipelines consume (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires valid authentication credentials (a Gitea account with at least a read-scoped token), limiting the attack surface to authenticated users. The EPSS score is approximately 0.013% (2nd percentile), indicating a low probability of near-term exploitation (Github Advisory, Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Upgrade Gitea to version 1.22.2 or later, which includes the fix for token scope propagation in NuGet, Conan, and container package registries (Gitea Release v1.22.2). As interim measures, administrators should audit existing token permissions to ensure tokens are scoped to the minimum required access level, and monitor package registry upload activity for unexpected changes. No configuration-based workaround is available that fully mitigates the issue without upgrading.

The vulnerability received routine coverage from vulnerability tracking services and security feeds shortly after disclosure on December 26, 2025. Red Hat tracked it via Bugzilla and assigned it medium severity. No notable researcher commentary, vendor statements beyond the release notes, or significant social media discussion has been identified (Red Hat Bugzilla, Gitea Release v1.22.2).