CVE-2025-69413: Gitea

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

Affected products

• Gitea Gitea: before 1.25.2 (fixed in 1.25.2)

Published 2026-01-01. Last modified 2026-06-17.