In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
Medium CVSS 5.3
Summary
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://blog.gitea.com/release-of-1.25.2/ Release Notes
- https://github.com/go-gitea/gitea/issues/35984 Issue Tracking
- https://github.com/go-gitea/gitea/pull/36002 Issue Tracking
- https://github.com/go-gitea/gitea/releases/tag/v1.25.2 Release Notes
Timeline
- nvd_ingest NVD