EUVD-2026-41605
GHSA-g9g6-qhrc-p3qc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network OAuth flow with no prior Gitea privilege needed keeps AV:N/AC:L/PR:N/UI:N, but re-enabling an account is an access/integrity failure with no availability impact, so A:N (unlike the published A:H).
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
AnalysisAI
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account was deliberately disabled by an administrator to silently regain access simply by signing in through a linked OAuth provider. The OAuth sign-in callback fails to honor the administrator's 'disabled' flag, effectively reversing an intended access-revocation action. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but the flaw undermines a core account-lifecycle control on a widely self-hosted platform.
Technical ContextAI
Gitea is a self-hosted, lightweight Git service written in Go that supports external identity providers via OAuth2/OpenID Connect. When an account is linked to an OAuth provider, the sign-in callback handler resolves the external identity to a local Gitea user and establishes a session. This CVE is classified as CWE-284 (Improper Access Control): the callback logic re-activates the associated local account without re-checking whether an administrator had set that account to a disabled/prohibited-login state. The root cause is a missing authorization gate on the account-state field during the OAuth login flow, so the disable action - normally enforced on password login - is not consistently enforced across all authentication paths. The affected component per CPE is cpe:2.3:a:gitea:gitea_open_source_git_server for all versions through 1.26.1.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.26.4 (the fix is also present in 1.26.3), per https://github.com/go-gitea/gitea/releases/tag/v1.26.4 and the advisory https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc; the code change is in PR https://github.com/go-gitea/gitea/pull/38009. If immediate upgrade is not possible, do not rely on the 'disable account' feature alone as a revocation control for OAuth-linked users: instead delete the account or unlink/remove its OAuth authentication source so no valid external identity can reactivate it, and where feasible revoke or de-authorize the user at the upstream OAuth/OIDC provider so the identity provider itself rejects the sign-in. The trade-off is that unlinking or deleting accounts is more disruptive and less reversible than a soft-disable, and provider-side revocation depends on administrative access to the external IdP. As always, verify the disabled state actually blocks login after applying any workaround.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository li
Server-side request forgery in Gitea Open Source Git Server (all versions through 1.26.4) lets attackers abuse the repos
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today