5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68944

CVE-2025-68944: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68944

CVE-2025-68944:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.22.2	1.22.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of access token scopes within Gitea's package registries. The root cause is that the scope of an access token was not correctly propagated and enforced during the authentication process for package operations.

Specifically, the services/packages.CreateAuthorizationToken function would generate a new JSON Web Token (JWT) for package access without embedding the scope of the original access token. Concurrently, the services/packages.ParseAuthorizationToken function would only extract the user ID from this JWT, completely ignoring any scope information.

This flaw was exploited in the authentication middleware for the Conan and Container registries (auth.Verify methods). These methods would use the vulnerable parser, effectively authenticating the user but failing to check if their token was actually permitted to access the package registry. The Authenticate functions for these registries also failed to perform the necessary scope checks.

The patch addresses this by modifying the JWT creation and parsing functions to include and extract the token scope. It also adds explicit scope validation checks in the Authenticate and Verify functions across the affected package registries (Conan, Container, and NuGet) to ensure that the user's token has the required read:package or write:package permissions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.