Skip to content
Threat Feed
Subscribe

Product

Go/Code.gitea.io/Gitea (Versions Prior to 1.27.0)

1 brief RSS
high advisory

Gitea OAuth2 Sign-in Flaw Reactivates Administrator-Deactivated Accounts

A vulnerability (CVE-2026-55987) in Gitea's OAuth2 sign-in allows administrator-deactivated user accounts to be reactivated upon re-authentication through specific authentication sources (like GitHub or OIDC/OAuth2 without refresh tokens), enabling users to regain full access, potentially including administrator privileges, by bypassing the intended deactivation.

go/code.gitea.io/gitea gitea vulnerability authentication account-takeover privilege-escalation
3t