VDB

CVE-2026-20904

CVE-2026-20904 PUBLISHED CVSS 6.5 MEDIUM

Gitea does not properly validate ownership when toggling OpenID URI visibility

Reported by gitea · Published January 22, 2026

github.com/go-gitea/gitea is fixed in 1.25.4 (Go Modules)

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/go-gitea/giteaGo Modules1.25.4
code.gitea.io/giteaGo Modules1.25.4
giteaBitnami1.25.4
Gitea Open Source Git ServerGitea1.25.3
giteagitea1.25.4
giteaBitnami1.25.4

Risk scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

VendorProductVersions
GiteaGitea Open Source Git Server0
GiteaGitea Open Source Git Server0

Timeline

  • Jan 13, 2026 Fix PR Merged (2 in total, the first dated here)
  • Jan 22, 2026 CVE Published
  • Jan 22, 2026 PoC Published (2 in total, the first dated here)
  • Jan 23, 2026 EPSS Score (30 in total, the first dated here)
  • Feb 8, 2026 CVE Updated
  • Mar 17, 2026 Security Advisory
  • Mar 25, 2026 Coalition ESS Score (2 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-20904
vulnetix vdb fixes CVE-2026-20904

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-20904/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›