Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20904US | — | — | ||
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.4/ARTICLE
- https://github.com/go-gitea/gitea/pull/36346FIX
- https://github.com/go-gitea/gitea/pull/36361FIX
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4ARTICLE
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqxWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-20904WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan