Go/code.gitea.io/gitea CVE-2026-20904: medium 6.5, EPSS 0.30%

Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

Action: Upgrade code.gitea.io/gitea to 1.25.4 or later.

go get code.gitea.io/gitea@v1.25.4

Affected

Fixed versions

Sources

• osv: GO-2026-4369
• nvd: CVE-2026-20904
• https://github.com/advisories/GHSA-qqgv-v353-cv8p
• https://blog.gitea.com/release-of-1.25.4
• https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22
• https://github.com/go-gitea/gitea/pull/36346
• https://github.com/go-gitea/gitea/pull/36361
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4

CVE-2026-20904 · published 2026-02-02T21:05:55Z · modified 2026-03-03T04:57:54.244003Z · JSON