CVE-2026-20904

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284 CWE-639

Affected software

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	<= 1.25.3

References

https://blog.gitea.com/release-of-1.25.4/Release Notes
https://github.com/go-gitea/gitea/pull/36346Issue Tracking, Patch
https://github.com/go-gitea/gitea/pull/36361Issue Tracking, Patch
https://github.com/go-gitea/gitea/releases/tag/v1.25.4Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqxBroken Link

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-209056.6Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a CVE-2026-209066.7Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an CVE-2026-209085.3Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a CVE-2026-209095.3Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.CVE-2026-209108.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote co CVE-2026-209119.8A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A spe CVE-2026-209129.1Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository c CVE-2026-209135.3Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an esc CVE-2026-209145.5Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow CVE-2026-209155.4Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pendin CVE-2026-209168.1An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint o CVE-2026-209174.0Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: