Description (CNA)
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Gitea / Gitea Open Source Git Server | affected 0 through 1.25.3 |
CWE
CWE-284, CWE-639
References
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx
- https://github.com/go-gitea/gitea/pull/36346
- https://github.com/go-gitea/gitea/pull/36361
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4
- https://blog.gitea.com/release-of-1.25.4/
ADP enrichment
No English description supplied.
No references supplied.