Threats Tagged 'cve-2026-20904'

CVE-2026-20904 is a medium severity vulnerability in the Gitea open source Git server where authenticated users can improperly toggle the visibility of other users' OpenID URIs due to insufficient ownership validation. This improper access control flaw allows attackers to alter identity visibility settings without authorization, potentially impacting user privacy and trust. The vulnerability requires authentication but no user interaction beyond that, and does not affect confidentiality directly but impacts integrity of user settings. There are no known exploits in the wild yet. European organizations using Gitea for source code management should assess their exposure and apply mitigations promptly. The vulnerability is particularly relevant for countries with strong open source adoption and active software development communities. Mitigation involves restricting access controls, auditing user permissions, and monitoring changes to OpenID visibility settings. No official patch links are currently available, so organizations should follow Gitea updates closely. Overall, this vulnerability highlights the importance of strict access control enforcement in collaborative development platforms.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-20904#cwe-284