CVE-2026-20904

Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

State: Published
Severity: 6.5 Medium
Published: Jan 22, 2026
Updated: Jan 23, 2026
Reserved: Jan 8, 2026

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

CWE-284 Improper Access Control
CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Gitea Open Source Git ServerGitea	1.25.3 and earlierAffected

References

GitHub Security Advisoryvendor-advisory
GitHub Pull Request #36346patch
GitHub Pull Request #36361patch
Gitea v1.25.4 Releaserelease-notes
Gitea v1.25.4 Release Blog Postrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.