Medium severity · published Jan 22, 2026
CVE-2026-20904
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Gitea Open Source Git Server · Gitea
through 1.25.3 · source: vendor
GI
Gitea · Gitea
before 1.25.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20904
Release Notes
https://blog.gitea.com/release-of-1.25.4/
Issue Tracking
https://github.com/go-gitea/gitea/pull/36346
Issue Tracking
https://github.com/go-gitea/gitea/pull/36361
Release Notes
https://github.com/go-gitea/gitea/releases/tag/v1.25.4
Broken Link
https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx
More from Gitea Open Source Git Server
9.8
CVE-2026-56654
Privilege Escalation via Access Token Scope Escalation in API
9.8
CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
9.8
CVE-2026-27780
Gitea pre-receive hook can miss branch-protection checks after scanner errors
9.8
CVE-2026-26292
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
9.8
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default