Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-20904US | — | — | ||
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://blog.gitea.com/release-of-1.25.4/ARTICLE
- https://github.com/go-gitea/gitea/pull/36346FIX
- https://github.com/go-gitea/gitea/pull/36361FIX
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4ARTICLE
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqxWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-20904WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan