CVE-2026-73804

Deferred Deferred - Pending Action

Token Spoofing via SSH Key Registration in Gitea

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73804

EUVD

EUVD-2026-101108

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

Gitea has a vulnerability where a token with write:user scope can be used to register an attacker-controlled SSH public key on the token owner's account. This allows the attacker to use the corresponding private key to sign API requests, bypassing token scope checks and gaining unscoped API access while retaining the account's normal permissions.

Detection Guidance

Check Gitea logs for unusual SSH key additions via the POST /api/v1/user/keys endpoint. Review HTTP Signature authentication attempts in access logs. Verify if any tokens with write:user scope have been used to register new SSH keys.

Impact Analysis

An attacker could exploit this to gain unauthorized access to your Gitea account, perform actions on your behalf, or access sensitive data. The impact is limited only by your account's existing role and repository permissions.

Compliance Impact

This vulnerability allows unauthorized API access by bypassing token scope checks, which could lead to unauthorized data access or modification. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it risks exposing protected health information if repository permissions are misused.

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later. Revoke and regenerate all tokens with write:user scope. Monitor for unauthorized SSH key additions and HTTP Signature authentication attempts.

Hi! I’m here to help you understand CVE-2026-73804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70