Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2026-20904

Good to know:

icon
icon

Date: January 22, 2026

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Severity Score

Related Resources (11)

https://github.com/go-gitea/gitea/releases/tag/v1.25.4
https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx
https://github.com/go-gitea/gitea/pull/36361
https://nvd.nist.gov/vuln/detail/CVE-2026-20904
https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22
https://blog.gitea.com/release-of-1.25.4/
https://github.com/advisories/GHSA-qqgv-v353-cv8p
https://github.com/go-gitea/gitea/pull/36346
https://blog.gitea.com/release-of-1.25.4
https://github.com/go-gitea/gitea
https://www.mend.io/vulnerability-database/CVE-2026-20904

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Authorization Bypass Through User-Controlled Key

CWE-639

Top Fix

icon

Upgrade Version

Upgrade to version github.com/go-gitea/gitea - v1.25.4;code.gitea.io/gitea - v1.25.4;https://github.com/go-gitea/gitea.git - v1.25.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us