CVE-2026-20904

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20904
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.gitea.com/release-of-1.25.4/ Release Notes
https://github.com/go-gitea/gitea/pull/36346 Issue Tracking Patch
https://github.com/go-gitea/gitea/pull/36361 Issue Tracking Patch
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*
History

17 Jun 2026, 10:18

Type Values Removed Values Added
Summary
  • (es) Gitea no valida correctamente la titularidad al alternar la visibilidad de la URI de OpenID. Un usuario autenticado podría cambiar la configuración de visibilidad de las identidades OpenID de otros usuarios.

29 Jan 2026, 22:03

Type Values Removed Values Added
References () https://blog.gitea.com/release-of-1.25.4/ - () https://blog.gitea.com/release-of-1.25.4/ - Release Notes
References () https://github.com/go-gitea/gitea/pull/36346 - () https://github.com/go-gitea/gitea/pull/36346 - Issue Tracking, Patch
References () https://github.com/go-gitea/gitea/pull/36361 - () https://github.com/go-gitea/gitea/pull/36361 - Issue Tracking, Patch
References () https://github.com/go-gitea/gitea/releases/tag/v1.25.4 - () https://github.com/go-gitea/gitea/releases/tag/v1.25.4 - Release Notes
References () https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx - () https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx - Broken Link
CPE cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*
First Time Gitea
Gitea gitea

23 Jan 2026, 22:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

22 Jan 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 22:16

Updated : 2026-06-17 10:18

NVD link : CVE-2026-20904

Mitre link : CVE-2026-20904

CVE.ORG link : CVE-2026-20904

JSON object : View

Products Affected

gitea

  • gitea
CWE
CWE-284

Improper Access Control

CWE-639

Authorization Bypass Through User-Controlled Key