VulnerabilityAnalyzed
CVE-2026-20904
Gitea does not properly validate ownership when toggling OpenID URI visibility.
MEDIUM 6.5EPSS 0.29%
Does this matter?
Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.
Description
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.29% probability · 21th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-639
- Affected
- gitea/gitea
- Source
- 88ee5874-cf24-4952-aea0-31affedb7ff2
References
- https://blog.gitea.com/release-of-1.25.4/Release Notes
- https://github.com/go-gitea/gitea/pull/36346Issue Tracking, Patch
- https://github.com/go-gitea/gitea/pull/36361Issue Tracking, Patch
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4Release Notes
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqxBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.