Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-20904

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

VectorNETWORK

PublishedJan 22, 2026, 22:16

Published By88ee5874-cf24-4952-aea0-31affedb7ff2

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/go-gitea/gitea(Go)01.25.4N/A

References

https://blog.gitea.com/release-of-1.25.4/
https://github.com/go-gitea/gitea/pull/36346
https://github.com/go-gitea/gitea/pull/36361
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx

Weakness Type

CWE-284

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK