GitHub Advisoryadvisory · Go

GHSA-qqgv-v353-cv8p Gitea does not properly validate ownership when toggling OpenID URI visibility

MEDIUM Published 2026-01-23 Modified 2026-01-23 Official page ↗
Aliases
CVE-2026-20904
Ecosystem
Go
Packages
github.com/go-gitea/gitea
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-284
Reviewed
2026-01-23

Affected packages

• Go github.com/go-gitea/gitea: < 1.25.4 → fixed in 1.25.4

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Related

Alias · CVE (1)

  • CVE-2026-20904 Gitea does not properly validate ownership when toggling OpenID URI visibility. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References