CVE-2026-20904CWE-284CWE-639

Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Medium · published January 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00302 · 21.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-01-22T22:01Z
EPSS history
Timeline
  • 22 JAN 22:01Z
    Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
    cvelistv5