CVEvulnerability

CVE-2026-20904

6.5 MEDIUM Published 2026-01-22 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-22
Last modified
2026-06-17
Assigner
88ee5874-cf24-4952-aea0-31affedb7ff2
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284, CWE-639

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Affected configurations

• gitea gitea (< 1.25.4)

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References