CVE-2026-20904
📋 TL;DR
This vulnerability in Gitea allows authenticated users to modify the visibility settings of other users' OpenID identities due to improper ownership validation. It affects all Gitea instances running vulnerable versions. Attackers could expose or hide OpenID URIs belonging to other users.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
An attacker could expose sensitive OpenID URIs of other users, potentially revealing personal information or enabling further attacks through identity association.
Likely Case
Malicious users could toggle visibility of other users' OpenID identities, causing confusion or minor privacy violations.
If Mitigated
With proper access controls and monitoring, impact is limited to visibility changes that can be audited and reversed.
🎯 Exploit Status
Requires authenticated access but exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.25.4
Vendor Advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx
Restart Required: Yes
Instructions:
1. Backup your Gitea instance. 2. Download Gitea 1.25.4 or later from official releases. 3. Stop Gitea service. 4. Replace binary with new version. 5. Restart Gitea service.
🔧 Temporary Workarounds
Disable OpenID Integration
allTemporarily disable OpenID functionality to prevent exploitation
Modify app.ini to disable OpenID: [openid] ENABLE_OPENID_SIGNIN = false
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized OpenID visibility changes
- Disable OpenID functionality until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check Gitea version: if version is less than 1.25.4, instance is vulnerableCheck Version:
./gitea --versionVerify Fix Applied:
Verify Gitea version is 1.25.4 or higher and test OpenID visibility functionality📡 Detection & Monitoring
Log Indicators:
- Unauthorized OpenID visibility toggle events in Gitea logs
- Multiple OpenID visibility changes from single user
Network Indicators:
- Unusual API calls to OpenID endpoints
SIEM Query:
source="gitea.log" AND "OpenID" AND "visibility" AND "toggle"