6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20904

CVE-2026-20904: Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20904

CVE-2026-20904:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-gitea/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of ownership verification when an authenticated user toggles the visibility of an OpenID URI. The root cause is in the user.ToggleUserOpenIDVisibility function in models/user/openid.go, which modified the database using only the OpenID's id, without checking which user it belonged to. The web handler security.ToggleOpenIDVisibility in routers/web/user/setting/security/openid.go exposed this vulnerability by calling the insecure model function with just the id from the request form. The patch addresses this by modifying user.ToggleUserOpenIDVisibility to accept a user object and adding a WHERE clause to the SQL query to check for the user's ID (uid). Consequently, the handler security.ToggleOpenIDVisibility was updated to pass the authenticated user's object (ctx.Doer) to the model function, ensuring that a user can only change the visibility of their own OpenID URIs.

Vulnerable functions

user.ToggleUserOpenIDVisibility

models/user/openid.go

The original version of this function was vulnerable to an improper access control vulnerability. It took only the OpenID `id` as an argument and toggled its visibility in the database. It lacked a check to verify that the user performing the action was the owner of the OpenID record, allowing any authenticated user to change the visibility of another user's OpenID URI.

security.ToggleOpenIDVisibility

routers/web/user/setting/security/openid.go

This function serves as the web handler for the toggle visibility feature. It was vulnerable because it called the insecure `user_model.ToggleUserOpenIDVisibility` function, passing only the OpenID `id` from the user's request. It did not provide the user's identity (`ctx.Doer`) to the model function, thereby failing to enforce ownership checks and allowing any authenticated user to modify the OpenID visibility of any other user.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.