{"action":"Upgrade code.gitea.io/gitea to 1.25.2 or later.","affected":[{"fixed":"1.25.2","introduced":"0"}],"component":"code.gitea.io/gitea","cve_ids":["CVE-2025-69413"],"ecosystem":"Go","epss":0.00386,"exploited":false,"fixed_versions":["1.25.2"],"ghsa_id":"GHSA-pc73-rj2c-wvf9","id":"tcs_01M5KFH7XCVCJ8SEHA3M1CNPQR","modified_at":"2026-02-03T03:14:32.347471Z","published_at":"2026-01-01T06:30:23Z","references":["https://osv.dev/vulnerability/GHSA-pc73-rj2c-wvf9","https://nvd.nist.gov/vuln/detail/CVE-2025-69413","https://github.com/go-gitea/gitea/issues/35984","https://github.com/go-gitea/gitea/pull/36002","https://blog.gitea.com/release-of-1.25.2","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.25.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-pc73-rj2c-wvf9","url":"https://osv.dev/vulnerability/GHSA-pc73-rj2c-wvf9"}],"summary":"Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists"}