Listen to this Post
The vulnerability in Gitea versions prior to 1.21.8 allows unauthorized disclosure of user login timestamps through the web interface. This occurs via the “explore/users” page that supports sorting by the “lastlogintime” field. When this sort parameter is applied, the system retrieves user records from the database including their last login times and displays them in the HTML response. The endpoint does not enforce proper authentication or authorization checks on the sort functionality, leading to information leakage. Attackers can send HTTP GET requests to the endpoint with the sort parameter set to lastlogintime, typically accessible without login. This exposes precise timestamps of user activity, which can be harvested automatically. The issue stems from the code that handles user exploration queries, where sortable columns include sensitive fields without filtering. The database query likely joins user tables and orders results by login time, then renders data via a template. Fixed in version 1.21.8 by removing the lastlogintime sort option or restricting its access to authenticated users only.
Platform: Gitea
Version: before 1.21.8
Vulnerability: Login time disclosure
Severity: Moderate
Date: Dec 26 2025
Prediction: Patch v1.21.8
What Undercode Say:
Analytics
curl -s “http://localhost:3000/explore/users?sort=lastlogintime”
grep -o “last-login-[0-9]” response.html
SQL query: SELECT FROM user ORDER BY last_login_time DESC;
how Exploit:
Access /explore/users?sort=lastlogintime
Protection from this CVE
Update to v1.21.8
Impact:
Privacy reconnaissance possible
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
