CVE-2026-20904

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-20904
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-20904.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-20904
Aliases
Downstream
Related
Published
2026-01-22T22:01:51.762Z
Modified
2026-07-15T01:49:18.644036576Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Details

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-639"
    ],
    "cna_assigner": "Gitea",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/20xxx/CVE-2026-20904.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
369830bada2fd8826a5135cb2fc66660a9bef708
Database specific 
{
    "cpe": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.25.3"
        },
        {
            "fixed": "1.25.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.9.99
v1.*
v1.0.0
v1.1.0
v1.10.0-dev
v1.10.0-rc1
v1.10.5
v1.11.0-dev
v1.11.0-rc1
v1.12.0-dev
v1.13.0-dev
v1.14.0-dev
v1.15.0-dev
v1.15.0-rc1
v1.16.0-dev
v1.16.0-rc1
v1.17.0-dev
v1.18.0-dev
v1.18.0-rc0
v1.19.0-dev
v1.19.0-rc0
v1.20.0-dev
v1.20.0-rc0
v1.21.0-dev
v1.21.0-rc0
v1.22.0-dev
v1.22.0-rc0
v1.22.0-rc1
v1.23.0-dev
v1.24.0-dev
v1.25.0
v1.25.0-dev
v1.25.0-rc0
v1.25.1
v1.25.2
v1.25.3
v1.26.0-dev
v1.5.0-dev
v1.5.0-rc1
v1.6.0-dev
v1.6.0-rc1
v1.7.0-dev
v1.9.0-dev
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-20904.json"