Back to overview

CVE-2026-25714

MEDIUM
4.3
CVSS 3.1
Description
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

Metadata

CVE ID
CVE-2026-25714
State
PUBLISHED
Assigner
Gitea
Reserved
2026-03-03 03:25 UTC
Published
2026-07-03 20:19 UTC
Last updated
2026-07-03 20:19 UTC
Primary CWE
CWE-862
CWE-862
Vendor / Product
Gitea / Gitea Open Source Git Server
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
Gitea Gitea Open Source Git Server — 0 ≤ 1.26.1
Weakness (CWE)
CWESourceDescription
CWE-862 cna CWE-862
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References (4)
Back to overview