Gitea does not properly validate ownership when toggling OpenID URI visibility
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20904US | — | — | ||
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.4WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22WEB
- https://github.com/go-gitea/gitea/pull/36346WEB
- https://github.com/go-gitea/gitea/pull/36361WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-20904ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan