5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68943

CVE-2025-68943: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68943

CVE-2025-68943:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.21.8	1.21.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-68943, allows unauthorized users to view sensitive user activity information, specifically their last login times, by manipulating the 'sort' parameter on the user and organization exploration pages. The root cause was a lack of input validation on this parameter.

The analysis of the patches reveals that the Users function in routers/web/explore/user.go and the Organizations function in routers/web/explore/org.go were the primary entry points for this vulnerability. These functions accepted the 'sort' parameter from the URL query string but did not validate it against a safe list of allowed values. The unsanitized parameter was then passed to the RenderUserSearch function, which constructed the database query. This allowed sorting by fields not intended to be public, such as lastlogintime.

The fix, implemented across several commits, introduces a strict whitelist of allowed sort orders (newest, oldest, alphabetically, reversealphabetically). Any attempt to use a sort order not on this list now results in a "Not Found" error. The vulnerable functions were those that handled the user request and failed to properly sanitize the input, leading to the information disclosure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.