Account Linking Vulnerability in Gitea by Gitea

CVE-2026-120263

What is CVE-2026-120263?

This vulnerability pertains to a flaw in the account linking process of Gitea when the 'oauth2_client.ACCOUNT_LINKING' feature is configured to 'auto'. When enabled, attackers could exploit this to link their external OAuth2 provider account to another user's Gitea account by merely submitting the username or email of that user. This means that an attacker who has an account on a recognized OAuth2 provider could gain unauthorized access to another user's account, including administrative accounts, without knowing their password. Recent updates have modified this behavior to ensure that automatic linking only occurs when the user’s account matches the OAuth2 provider’s email or username, thereby requiring password authentication for other scenarios.

References