Authentication Flaw in Gitea Allows Unauthorized API Access
CVE-2026-73804

8.1HIGH

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-73804?

A vulnerability in Gitea allows an attacker to manipulate a token with write:user scope and register an unauthorized SSH public key to the token owner's account. This flaw permits API requests signed by the corresponding private key to authenticate successfully as the account owner, bypassing essential route-level token scope checks. As a result, the token transitions into an unscoped API authentication method, retaining the owner's assigned roles and permissions, thus facilitating unauthorized access to protected resources.

Affected Version(s)

Gitea 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.2/
release-notes
https://github.com/go-gitea/gitea/pull/38862
patch

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/ohxorud-dev
https://github.com/bircni
https://github.com/lunny
https://github.com/delvh
https://github.com/wxiaoguang
https://github.com/TheFox0x7
.