Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-68943 · ADVISORY
• go-gitea/gitea#29430 · WEB
• blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10 · WEB
• go-gitea/gitea · PACKAGE
• go-gitea/gitea release v1.21.8 · WEB
• blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10 · Release Notes
• GitHub Advisory GHSA-jhx5-4vr4-f327 · ADVISORY

Mais vulnerabilidades de code.gitea.io/gitea

• CVE-2026-59766MÉDIO 4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wi…
• CVE-2026-60004CRÍTICO 9.8EXPLOITED (CISA KEV)Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
• CVE-2026-59763MÉDIO 4.3Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
• CVE-2026-58511BAIXO 2.7Webhook Authorization Header Returned in Plaintext via API
• CVE-2026-58510MÉDIO 4.3GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private