GHSA-qqgv-v353-cv8p

Gitea does not properly validate ownership when toggling OpenID URI visibility

At a glance

Published: 2026-01-23 00:31 UTC
Updated: 2026-02-03 03:08 UTC
CVE: CVE-2026-20904
Aliases: BIT-gitea-2026-20904, GHSA-jrpc-w85r-hgqx, GO-2026-4369
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Affected packages

Package	Versions
Go · github.com/go-gitea/gitea	introduced 0, fixed 1.25.4

References

https://nvd.nist.gov/vuln/detail/CVE-2026-20904 ADVISORY
https://github.com/go-gitea/gitea/pull/36346 WEB
https://github.com/go-gitea/gitea/pull/36361 WEB
https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22 WEB
https://blog.gitea.com/release-of-1.25.4 WEB
https://github.com/go-gitea/gitea PACKAGE
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database