Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)

Gitea's OAuth2 sign-in callback incorrectly reactivates administrator-deactivated user accounts (`IsActive=false`) when the authentication source does not issue refresh tokens, such as GitHub or any OIDC/OAuth2 source configured without `offline_access`. The reactivation gate introduced by PR #38009 uses an empty stored refresh token as its signal, but this is the normal state for all users on such sources, making it impossible to distinguish a cron-disabled account from one deliberately deactivated by an administrator. A deactivated user can restore their own account and obtain a full session by simply signing in through the affected provider, regaining all prior access including administrative privileges if applicable. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 8.1 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-vrhc-jjfc-m3m3 Details: https://vuln.today/cve/CVE-2026-55987