Gitea Login Time Disclosure Vulnerability

A vulnerability in Gitea versions prior to 1.21.8 allows for the unintended disclosure of users' login times. This occurs through the 'lastlogintime' sort order on the '/explore/users' page, which can inadvertently reveal user activity.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of user activity, specifically login times.

Reproduction

To reproduce this vulnerability, access the '/explore/users' page on a Gitea instance running a vulnerable version. Sort the user list by 'lastlogintime'. This will display users' login times, unintentionally revealing their activity.

Remediation

Users are advised to upgrade to Gitea version 1.21.8 or later.