Gitea does not properly validate ownership when toggling OpenID URI visibility

MOYENNE 6.5CVE-2026-20904 · BIT-gitea-2026-20904 · GHSA-jrpc-w85r-hgqx · Published 22/01/2026 · updated 17/06/2026

En bref

CVE-2026-20904 est une vulnérabilité MOYENNE (CVSS 6.5) touchant code.gitea.io/gitea, github.com/go-gitea/gitea, gitea (gitea).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.30%, plus élevée que 22.9% des vulnérabilités.
Correctif : mettre à jour vers 1.25.4 ou plus récent.

Package	Affected versions	Patched versions
code.gitea.io/gitea Go	`< 1.25.4`	`1.25.4`
github.com/go-gitea/gitea Go	`< 1.25.4`	`1.25.4`
gitea gitea	`< 1.25.4`	`1.25.4`

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

NVD description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

References

nvd.nist.gov/vuln/detail/CVE-2026-20904 · ADVISORY
go-gitea/gitea#36346 · WEB
go-gitea/gitea#36361 · WEB
go-gitea/gitea commit ed5720a · WEB
blog.gitea.com/release-of-1.25.4 · WEB
go-gitea/gitea · PACKAGE
go-gitea/gitea release v1.25.4 · WEB
blog.gitea.com/release-of-1.25.4 · Release Notes
go-gitea/gitea security advisory · Broken Link
GitHub Advisory GHSA-qqgv-v353-cv8p · ADVISORY

Autres vulnérabilités de code.gitea.io/gitea

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

En bref

CVE-2026-20904 est une vulnérabilité MOYENNE (CVSS 6.5) touchant code.gitea.io/gitea, github.com/go-gitea/gitea, gitea (gitea).

Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.30%, plus élevée que 22.9% des vulnérabilités.

Correctif : mettre à jour vers 1.25.4 ou plus récent.

Package

Affected versions

Patched versions

code.gitea.io/gitea

< 1.25.4

1.25.4

github.com/go-gitea/gitea

< 1.25.4

1.25.4

gitea

< 1.25.4

1.25.4

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

NVD description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Autres vulnérabilités de code.gitea.io/gitea

Tout voir →