GHSA-qqgv-v353-cv8p

Gitea does not properly validate ownership when toggling OpenID URI visibility

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-20904

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/go-gitea/gitea	< 1.25.4	1.25.4

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-20904 advisory
https://github.com/go-gitea/gitea/pull/36346 web
https://github.com/go-gitea/gitea/pull/36361 web
https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22 web
https://blog.gitea.com/release-of-1.25.4 web
https://github.com/go-gitea/gitea package
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 web