Gitea fails to enforce proper ownership checks when an authenticated user toggles the visibility of an OpenID URI. As a result, a user can alter the visibility settings of another user’s OpenID identity, potentially exposing or concealing that identifier from unintended audiences. This vulnerability represents a broken access control flaw (CWE‑284) combined with an authority misuse issue (CWE‑639). The impact is the unauthorized manipulation of user identity exposure, which can lead to privacy violations and weaken the trust model of the platform. The CVE description does not indicate any code execution or data exfiltration beyond visibility changes.

Gitea Open Source Git Server versions without the 1.25.4 patch. Versions prior to the release that fixes the ownership validation are at risk. No specific version range is listed in the CNA data, so all installations before the patch are susceptible.

The CVSS score of 6.5 classifies the vulnerability as medium severity. The EPSS score is below 1%, indicating a very low probability of exploitation in the wild, and the issue is not recorded in the CISA KEV catalog. The likely attack vector requires the attacker to be an authenticated user on the target system; no remote code execution or unauthenticated access is required. Nevertheless, the impact on user privacy and trust warrants prompt attention.