{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gitea-all-versions-prior-to-1.26.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-58422"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea (All versions prior to 1.26.4)"],"_cs_severities":["high"],"_cs_tags":["improper-authorization","oauth","account-takeover","persistence","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Gitea Ltd"],"content_html":"\u003cp\u003eA high-severity improper authorization vulnerability, identified as CVE-2026-58422, affects Gitea versions prior to 1.26.4. This flaw allows users whose accounts have been disabled by an administrator to bypass this restriction and regain full access to their Gitea repositories, organizations, and access tokens. The vulnerability resides within the OAuth2 sign-in callback functionality, specifically in the \u003ccode\u003ehandleOAuth2SignIn\u003c/code\u003e function. When a user with a previously linked external identity provider attempts to authenticate through OAuth2, the Gitea application logic incorrectly re-enables their locally disabled account and grants them a fresh authenticated session. This effectively nullifies administrator-initiated account disablement, posing a significant risk to incident response efforts, especially in environments relying on account deactivation for compromised or departed user scenarios.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn administrator configures an OAuth2 authentication source within Gitea, linking it to an external Identity Provider (IdP).\u003c/li\u003e\n\u003cli\u003eA user, e.g., \u0026quot;Alice,\u0026quot; signs into Gitea at least once via this OAuth2 source, establishing a link between her local Gitea account and the external IdP.\u003c/li\u003e\n\u003cli\u003eA Gitea administrator subsequently disables Alice's account through the \u003ccode\u003eSite Administration\u003c/code\u003e panel, setting her \u003ccode\u003eIsActive\u003c/code\u003e flag to \u003ccode\u003efalse\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAlice attempts to sign in again using the previously linked external IdP, triggering the OAuth2 authentication flow.\u003c/li\u003e\n\u003cli\u003eThe Gitea application's \u003ccode\u003e/user/oauth2/{source-name}/callback\u003c/code\u003e endpoint processes the authentication request.\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003erouters/web/auth/oauth.go::handleOAuth2SignIn\u003c/code\u003e function, the application reads the user's \u003ccode\u003eIsActive\u003c/code\u003e flag and, despite it being \u003ccode\u003efalse\u003c/code\u003e, incorrectly sets \u003ccode\u003eopts.IsActive = optional.Some(true)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003euser_service.UpdateUser\u003c/code\u003e function is called, which updates Alice's account in the database, effectively re-enabling it without administrative approval.\u003c/li\u003e\n\u003cli\u003eGitea issues a new authenticated session to Alice, granting her full read and write access to her repositories, organizations, and tokens, bypassing the administrator's disable action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows users to circumvent administrative account disablement, leading to unauthorized access and persistence. In organizations utilizing Gitea, particularly those integrated with Single Sign-On (SSO) systems where account disablement is a critical incident response measure for compromised credentials or employee departures, this flaw completely undermines security protocols. Affected Gitea deployments risk former employees or attackers with compromised external IdP access continuously regaining access, leading to data exfiltration, unauthorized code commits, or other malicious activities, even after an administrator has attempted to revoke access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Gitea installations to version 1.26.4 or later immediately to address CVE-2026-58422.\u003c/li\u003e\n\u003cli\u003eReview audit logs for \u003ccode\u003eUpdateUser\u003c/code\u003e actions originating from OAuth callback processes for users previously disabled by an administrator.\u003c/li\u003e\n\u003cli\u003eConsider implementing out-of-band monitoring for unexpected account re-activations, especially for accounts marked as disabled.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T21:52:53Z","date_published":"2026-07-21T21:52:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-oauth-reenable/","summary":"An improper authorization vulnerability in Gitea's OAuth2 sign-in callback mechanism (CVE-2026-58422) allows users with linked external identity providers to unilaterally re-enable their administrator-disabled accounts, regaining full access and bypassing security controls.","title":"Gitea OAuth Callback Re-enables Administrator-Disabled Accounts","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-oauth-reenable/"}],"language":"en","title":"CraftedSignal Threat Feed - Gitea (All Versions Prior to 1.26.4)","version":"https://jsonfeed.org/version/1.1"}