Gitea
CVE-2026-56750
CRITICAL
GHSA-rgv6-xp99-6mgj
Severity by source
AC:H and UI:R because exploitation depends on prior out-of-band token theft plus the victim later reusing their original token; full account control gives C/I/A:H.
Lifecycle Timeline
3DescriptionCVE.org
The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).
The vulnerable function is this one:
https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64
Affected Endpoint
POST /user/login (and any endpoint triggering autoSignIn via the Remember-Me cookie).
Description
Gitea implements Remember-Me cookies using a split token design (ID:Hash), citing the Paragonie secure remember-me guide. When a token is used, its Hash is rotated, but the ID remains the same.
If an attacker steals a user's Remember-Me token and uses it to authenticate, the attacker is issued a new rotated token (same ID, new Hash). When the legitimate user later attempts to use their original token, Gitea correctly detects a hash mismatch for the given ID.
According to the referenced Paragonie specification, this indicates a compromised token, and ALL active remember-me sessions for that user MUST be invalidated. However, Gitea's CheckAuthToken function simply returns ErrAuthTokenInvalidHash. The calling code (autoSignIn) catches this error and deletes the victim's local cookie via ctx.DeleteSiteCookie, but fails to delete the compromised token from the database.
As a result, the attacker's active session is never invalidated, and the attacker maintains persistent, indefinite access to the victim's account, entirely defeating the purpose of the split-token security design.
AnalysisAI
Persistent account takeover in Gitea versions prior to 1.27.0 arises because the Remember-Me (gitea_incredible) split-token design fails to revoke a compromised token after detecting hash-mismatch reuse. An attacker who has already stolen a victim's Remember-Me cookie authenticates, receives a rotated token under the same ID, and remains logged in indefinitely - because when the legitimate user's original token later triggers a detected hash mismatch, Gitea deletes only the victim's local cookie and never removes the compromised token row from the database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY obtained a valid Remember-Me (gitea_incredible) cookie for a target account and that the victim has the Remember-Me feature enabled (a non-zero LOGIN_REMEMBER_DAYS, which is the default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS or EPSS score was provided, and the CVE is not on CISA KEV, so quantitative exploitation-probability signals are absent and must be reasoned from the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains a victim's Remember-Me cookie - for example through a stored XSS payload, a shared workstation, or an exposed backup - and replays it against POST /user/login, receiving a freshly rotated token bound to the same token ID. When the real user next returns and their now-stale token produces a detected hash mismatch, Gitea only clears the victim's browser cookie and leaves the attacker's rotated token valid in the database, so the attacker keeps full access to the account indefinitely. … |
| Remediation | Vendor-released patch: upgrade to Gitea 1.27.0 or later (release https://github.com/go-gitea/gitea/releases/tag/v1.27.0), which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Gitea installations and identify those running versions prior to 1.27.0; prioritize instances containing sensitive code or credentials and consider implementing temporary session timeout policies to limit Remember-Me token validity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today