CVE-2026-55987
Received Received - Intake

OAuth2 Sign-In Reactivates Deactivated Admin Accounts

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-55987
EUVD
EUVD-2026-58141

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea From 1.27.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows OAuth2 sign-in to reactivate an administrator-deactivated account when the authentication source does not issue refresh tokens, such as GitHub or OIDC/OAuth2 without offline_access. The incomplete fix in PR #38009 incorrectly used an empty refresh token to reactivate users, which is normal for sources without refresh tokens. This bypasses administrator deactivation, allowing users to regain access, including admin privileges.

Detection Guidance

Check Gitea logs for OAuth2 sign-in events that reactivate deactivated accounts. Look for entries in routers/web/auth/oauth.go where empty refresh tokens trigger account reactivation. Verify if authentication sources like GitHub or OIDC/OAuth2 without offline_access are configured.

Impact Analysis

This vulnerability allows deactivated users to regain access to the system, including administrative privileges if the account was an administrator. It bypasses administrator deactivation, potentially leading to unauthorized access, data breaches, or system misuse.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. It undermines administrator-enforced deactivation policies, risking non-compliance with regulatory mandates for user access management.

Mitigation Strategies

Update Gitea to the latest version to apply the complete fix for incomplete PR #38009. Disable OAuth2 sign-in for affected authentication sources or ensure refresh tokens are properly handled. Review and deactivate any reactivated accounts manually.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55987. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart