{"items":[{"id":"NVI-00018391","kind":"vulnerability","title":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8629-vc8r-5p58","CVE-2026-25714"],"plain_summary":"GitHub lists this reviewed advisory for code.gitea.io/gitea. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1bd5899cb87554417f7d3f66dce34fcb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-16T23:41:33.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1bd5899cb87554417f7d3f66dce34fcb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1bd5899cb87554417f7d3f66dce34fcb","url":"https://github.com/advisories/GHSA-8629-vc8r-5p58","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8629-vc8r-5p58","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:20:20.042Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1bd5899cb87554417f7d3f66dce34fcb"],"technology":"code.gitea.io/gitea","known_exclusions":[],"conditions_summary":"## Summary\n\nTwo related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data.\n\n## Issue 1: /user/orgs missing checkTokenPublicOnly()\n\n`routers/api/v1/api.go` line 1599:\n```go\nm.Get(\"/user/orgs\", reqToken(), tokenRequiresScopes(\n    auth_model.AccessTokenScopeCategoryUser,\n    auth_model.AccessTokenScopeCategoryOrganization,\n), org.ListMyOrgs)\n// Missing checkTokenPublicOnly()\n```\n\nAdjacent route at line 1603 has it:\n```go\nm.Group(\"/users/{username}/orgs\", func() { ... },\n    ..., checkTokenPublicOnly())\n```\n\n## Issue 2: checkTokenPublicOnly switch-case evaluates only first matching category\n\n`routers/api/v1/api.go` lines 253-295. Go switch executes only the first matching case. For routes with categories [User, Organization]:\n\n1. Organization case matches first (line 263)\n2. ctx.Org.Organization is nil on user routes, passes\n3. ctx.ContextUser.IsOrganization() is false, passes\n4. User case (line 273) is never reached\n5. User visibility check skipped entirely\n\n## Steps to Reproduce\n\n1. Create a token with public-only scope (Settings > Applications > check \"public only\")\n2. ","public_affected_ranges":["<= 1.26.1"]}],"null_published_at":"2026-11-07T07:07:39.831Z","source_updated_at":"2026-06-16T23:41:33.000Z","source_disclosed_at":"2026-06-16T23:41:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:20:20.042Z"}],"next_cursor":null,"snapshot_revision":"42594"}