GHSA-qqgv-v353-cv8p

Gitea does not properly validate ownership when toggling OpenID URI visibility

En bref

Publiée: 2026-01-23 00:31 UTC
Mise à jour: 2026-02-03 03:08 UTC
CVE: CVE-2026-20904
Alias: BIT-gitea-2026-20904, GHSA-jrpc-w85r-hgqx, GO-2026-4369
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Paquets affectés

Paquet	Versions
Go · github.com/go-gitea/gitea	introduced 0, fixed 1.25.4

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-20904 ADVISORY
https://github.com/go-gitea/gitea/pull/36346 WEB
https://github.com/go-gitea/gitea/pull/36361 WEB
https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22 WEB
https://blog.gitea.com/release-of-1.25.4 WEB
https://github.com/go-gitea/gitea PACKAGE
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database