Authentication Flaw in Gitea Allows Unauthorized API Access

CVE-2026-73804

What is CVE-2026-73804?

A vulnerability in Gitea allows an attacker to manipulate a token with write:user scope and register an unauthorized SSH public key to the token owner's account. This flaw permits API requests signed by the corresponding private key to authenticate successfully as the account owner, bypassing essential route-level token scope checks. As a result, the token transitions into an unscoped API authentication method, retaining the owner's assigned roles and permissions, thus facilitating unauthorized access to protected resources.

References