---
cve: "CVE-2025-68945"
severity: "MEDIUM"
cvss: 5.8
epss: "0.4%"
vendor: "Gitea"
kev: false
exploited: false
published: "2025-12-26 04:15:41"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-07T01:38:50+01:00"
---

# CVE-2025-68945

> 5.8 MEDIUM · 🧪 PoC

## Beschreibung

In Gitea before 1.21.2, an anonymous user can visit a private user's project.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2025-12-26 18:59:29
- CNA-CVSS: **5.8** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-359** — Exposure of Private Personal Information to an Unauthorized Actor
  The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

## Angriffsmuster (CAPEC)

- [CAPEC-464 — Evercookie](https://capec.mitre.org/data/definitions/464.html) _(Severity: Medium)_
- [CAPEC-467 — Cross Site Identification](https://capec.mitre.org/data/definitions/467.html) _(Severity: Low)_
- [CAPEC-498 — Probe iOS Screenshots](https://capec.mitre.org/data/definitions/498.html)
- [CAPEC-508 — Shoulder Surfing](https://capec.mitre.org/data/definitions/508.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1606.001 — Forge Web Credentials: Web Cookies](https://attack.mitre.org/techniques/T1606/001/)

## Patch verfügbar (OSV)

- 96d3fcf179d4eea98f62d380e04f246ff65694d7 (Commit)

## BSI-Hinweise (deutsch)

- [Gitea: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2025-2925) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, und um Dateien zu manipulieren.

## Referenzen

- <https://blog.gitea.com/release-of-1.21.2/>
- <https://github.com/go-gitea/gitea/releases/tag/v1.21.2>
- <https://github.com/go-gitea/gitea/pull/28423>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-68945/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_