CVE-2026-20904: Gitea OpenID URI Visibility Toggle Vulnerability
Summary
CVE-2026-20904: Gitea does not properly validate ownership when toggling OpenID URI visibility. Affects github.com/go-gitea/gitea versions < 1.25.4. Fixed in 1.25.4. How to fix ↓
Also tracked for
- code.gitea.io/gitea · Go
- gitea · Bitnami
The same CVE-2026-20904 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that provides a user-friendly interface for managing Git repositories. It supports features such as issue tracking, pull requests, and team collaboration. However, a vulnerability has been identified in Gitea that affects the visibility settings of OpenID URIs, potentially allowing unauthorized changes by authenticated users.
Vulnerability Detail
The vulnerability arises from Gitea's inadequate validation of ownership when users attempt to toggle the visibility of their OpenID URIs. This flaw allows an authenticated user to manipulate the visibility settings of other users' OpenID identities, which could lead to privacy breaches and unauthorized access to sensitive information. The issue is classified under CWE-284, indicating improper access control.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.4
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.25.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to their Gitea instance by limiting authenticated user permissions until the update can be applied. Additionally, consider disabling OpenID URI visibility toggling for all users until the patch is implemented.
Conclusion
The Gitea vulnerability CVE-2026-20904 poses a significant risk by allowing unauthorized changes to OpenID URI visibility settings. Users are strongly encouraged to update to version 1.25.4 or later to mitigate this risk. In the meantime, implementing workarounds can help protect sensitive information.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Any Gitea user who has enabled OpenID URI visibility settings may be affected, particularly if they have multiple authenticated users on their instance.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing stricter access controls and monitoring user activities related to OpenID settings.
You can find more information about Gitea vulnerabilities on the official Gitea GitHub repository and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
