CVE-2026-20904: 
Gitea vulnerability analysis and mitigation

CVE-2026-20904 is an improper access control vulnerability in Gitea that allows an authenticated user to modify the OpenID URI visibility settings of other users' OpenID identities without authorization. It affects all Gitea versions prior to 1.25.4. The vulnerability was published on January 22, 2026, with the fix merged on January 13, 2026, and released in Gitea v1.25.4 on January 22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Moderate) (GitHub Advisory, Gitea Release).

The root cause is classified as CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key). When a user toggles the visibility of an OpenID URI, Gitea fails to validate that the OpenID identity being modified belongs to the requesting user, allowing any authenticated user to supply another user's OpenID record identifier and alter its visibility state. The fix was implemented in pull requests #36346 and #36361, which added proper ownership checks to the OpenID settings handler (GitHub Advisory, PR #36346, PR #36361).

An authenticated attacker with low privileges can modify the visibility settings of OpenID identities belonging to other users without authorization. This could result in unintended exposure of another user's OpenID authentication credentials (making a private OpenID URI public) or restriction of access by hiding a user's OpenID identity, potentially disrupting legitimate authentication flows. There is no confidentiality or availability impact; the primary risk is unauthorized integrity modification of user authentication configuration data (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session on the target Gitea instance, limiting the attack surface to registered users (GitHub Advisory).

1. Authenticate: Log in to the target Gitea instance with any valid low-privilege user account.
2. Enumerate OpenID identities: Identify the numeric ID of another user's OpenID URI record, potentially through API enumeration or by observing network requests when managing your own OpenID settings.
3. Craft a malicious request: Send an HTTP request to the Gitea endpoint responsible for toggling OpenID URI visibility (e.g., a POST to the user settings OpenID toggle action), substituting the target user's OpenID record ID in place of your own.
4. Modify visibility: Because ownership is not validated server-side, the request succeeds and the target user's OpenID URI visibility is changed (e.g., from private to public or vice versa).
5. Impact: The victim's OpenID authentication configuration is altered without their knowledge, potentially exposing their OpenID URI or disrupting their ability to authenticate via OpenID (GitHub Advisory, PR #36346).

• Logs: Gitea access logs showing authenticated POST requests to OpenID settings toggle endpoints where the acting user's ID does not match the owner of the OpenID record being modified.
• Logs: Repeated or unusual requests to OpenID visibility toggle endpoints from a single user account targeting multiple different OpenID record IDs.
• Application: Unexpected changes to OpenID URI visibility settings for user accounts, particularly if users report their OpenID configuration was altered without their action.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability via pull requests #36346 and #36361. No configuration-based workaround is available; patching is the only remediation. Administrators should prioritize upgrading instances where OpenID authentication is enabled and multiple users have OpenID identities configured. After upgrading, review audit logs to determine whether unauthorized OpenID visibility changes occurred prior to patching (Gitea Release, PR #36346).

The vulnerability received routine coverage from automated CVE tracking services and vulnerability databases. The Gitea project addressed the issue quietly as part of a broader security-focused patch release (v1.25.4), which included eight other security fixes. No notable independent researcher commentary or significant media coverage has been identified beyond standard advisory publication (Gitea Release, GitHub Advisory).