CVE-2026-20904 — AI Deep Analysis Summary

🚨 **Root Cause**: When Gitea switches the visibility of OpenID URIs, it **fails to properly verify ownership**. 💥 **Impact**: Authenticated users can **tamper with the OpenID visibility settings** of other users.

🔍 **Vulnerability Point**: Missing logical validation. 📉 **CWE Tendency**: Broken Access Control (Lack of ownership check). ⚠️ **Core Issue**: The system allows users to modify the visibility status of OpenID URIs that t…

📦 **Component**: Gitea (a lightweight Git service developed in Go). 📅 **Affected Versions**: All versions prior to v1.25.4. ✅ **Fixed Version**: v1.25.4.

🕵️ **Attacker Capabilities**: 1. **Privacy Leakage**: Forcefully change other users' OpenID visibility (e.g., from private to public). 2.…

🔑 **Difficulty**: **Low**. ✅ **Prerequisite**: Only requires a standard **authenticated** user account. ⛔ **Not Required**: Administrator privileges or remote code execution vulnerabilities.

📜 **Exp/PoC**: 🚫 **No Public PoC**: The `pocs` field is empty in the data. 🌍 **In-the-Wild Exploitation**: No reports available. 🔗 **Fixing PRs**: #36361 and #36346 have been merged.

🔎 **Self-Check Method**: 1. **Check Version**: Confirm if the Gitea version is < v1.25.4. 2. **Review Logs**: Check for any operations modifying OpenID URI visibility where the user is not the owner. 3.…

🛡️ **Officially Fixed**: ✅ **Patch**: **Gitea v1.25.4** has been released. 📝 **Details**: See GitHub Security Advisory (GHSA-jrpc-w85r-hgqx) and the official blog.

🚧 **Temporary Mitigation**: 1. **Upgrade**: Immediately upgrade to v1.25.4 or later. 2. **Restrict Permissions**: Limit the ability of regular users to modify OpenID settings (if supported by the UI). 3.…

⚡ **Priority**: **Medium-High**. 📌 **Reason**: Involves **privacy leakage** and **unauthorized operations**, with a low exploitation threshold (requires only login).…