PT-2026-4293 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20904

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authenticated user may be able to modify the visibility settings of other users' OpenID identities due to improper ownership validation when toggling OpenID URI visibility.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

BIT-GITEA-2026-20904

CVE-2026-20904

GHSA-JRPC-W85R-HGQX

GHSA-QQGV-V353-CV8P

GO-2026-4369

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 95

• https://github.com/go-gitea/gitea/pull/36346 · Patch
• https://github.com/go-gitea/gitea/pull/36361 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20904 · Security Note
• https://osv.dev/vulnerability/GO-2026-4369 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20904 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qqgv-v353-cv8p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20904 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22 · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note