{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/go/code.gitea.io/gitea-versions-prior-to-1.27.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["go/code.gitea.io/gitea (versions prior to 1.27.0)"],"_cs_severities":["high"],"_cs_tags":["gitea","vulnerability","authentication","account-takeover","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Gitea"],"content_html":"\u003cp\u003eA critical vulnerability, CVE-2026-55987, has been identified in Gitea versions prior to 1.27.0, where its OAuth2 sign-in callback function can inadvertently reactivate user accounts that an administrator had explicitly deactivated. This flaw stems from an incomplete fix (PR #38009) that incorrectly interprets an empty refresh token as a signal for auto-sync disabled accounts, rather than accounts deliberately deactivated by an administrator. This condition commonly occurs when Gitea instances are configured with GitHub as an authentication source, or with any OpenID Connect (OIDC) or OAuth2 provider that does not issue refresh tokens (i.e., configured without \u003ccode\u003eoffline_access\u003c/code\u003e). A deactivated user can simply sign in again through these authentication methods, bypassing the administrator's security control and regaining full access to their previous Gitea session, which could include administrator privileges if the account previously held them. This undermines account management and access control within affected Gitea deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe Gitea instance is configured with a GitHub OAuth2 authentication source or an OIDC/OAuth2 source without \u003ccode\u003eoffline_access\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAn administrator manually deactivates a user account by setting its \u003ccode\u003eIsActive\u003c/code\u003e status to \u003ccode\u003efalse\u003c/code\u003e in the Gitea Admin Panel.\u003c/li\u003e\n\u003cli\u003eThe deactivated user attempts to sign in to Gitea using the configured GitHub or OIDC/OAuth2 authentication source.\u003c/li\u003e\n\u003cli\u003eGitea's \u003ccode\u003erouters/web/auth/oauth.go\u003c/code\u003e \u003ccode\u003ehandleOAuth2SignIn\u003c/code\u003e function processes the authentication callback.\u003c/li\u003e\n\u003cli\u003eDuring this process, the function attempts to retrieve the user's \u003ccode\u003eexternal_login_user\u003c/code\u003e record, where the \u003ccode\u003erefresh_token\u003c/code\u003e field is legitimately empty for these specific OAuth2 sources.\u003c/li\u003e\n\u003cli\u003eThe Gitea logic incorrectly interprets \u003ccode\u003eextLogin.RefreshToken == \u0026quot;\u0026quot;\u003c/code\u003e as a sign that the account was disabled by an auto-sync cron job, rather than by an administrator.\u003c/li\u003e\n\u003cli\u003eConsequently, Gitea sets the \u003ccode\u003eIsActive\u003c/code\u003e status of the user account back to \u003ccode\u003etrue\u003c/code\u003e, reactivating it (\u003ccode\u003eopts.IsActive = optional.Some(true)\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe user successfully logs in and obtains a full, active Gitea session, regaining all previous access and privileges, thereby circumventing the administrator's deactivation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability impacts any Gitea instance utilizing GitHub or OIDC/OAuth2 authentication sources without \u003ccode\u003eoffline_access\u003c/code\u003e that relies on the \u0026quot;Activated\u0026quot; toggle for account deactivation. If exploited, an administrator-deactivated user account will be reactivated, granting the user full access to their previous session and resources. This means a former administrator, whose account was deactivated for security reasons, could regain their administrative privileges and potentially access sensitive code repositories, perform unauthorized actions, or compromise the Gitea instance. The flaw directly undermines access control mechanisms and could lead to unauthorized data manipulation, intellectual property theft, or further lateral movement within an organization's development infrastructure. The exact number of affected organizations is unknown, but Gitea is widely used by development teams globally.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-55987 by upgrading all Gitea instances to version 1.27.0 or newer immediately, as specified in the advisory referenced in this brief.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for unexpected changes to the \u003ccode\u003eis_active\u003c/code\u003e status in the Gitea database for accounts that have been explicitly deactivated by an administrator.\u003c/li\u003e\n\u003cli\u003eReview and audit all Gitea authentication sources, especially GitHub and OIDC/OAuth2 configurations, to understand which ones do not issue refresh tokens and are thus susceptible to this reactivation flaw.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T21:03:29Z","date_published":"2026-07-21T21:03:29Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-oauth2-reactivation-flaw/","summary":"A vulnerability (CVE-2026-55987) in Gitea's OAuth2 sign-in allows administrator-deactivated user accounts to be reactivated upon re-authentication through specific authentication sources (like GitHub or OIDC/OAuth2 without refresh tokens), enabling users to regain full access, potentially including administrator privileges, by bypassing the intended deactivation.","title":"Gitea OAuth2 Sign-in Flaw Reactivates Administrator-Deactivated Accounts","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-oauth2-reactivation-flaw/"}],"language":"en","title":"CraftedSignal Threat Feed - Go/Code.gitea.io/Gitea (Versions Prior to 1.27.0)","version":"https://jsonfeed.org/version/1.1"}