CVE-2026-73804 Details
Description
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
A vulnerability in Gitea allows a token with 'write:user' scope to register an attacker-controlled SSH public key on the token owner's account. This is achieved by using the Gitea API to add the SSH key, which then authenticates API requests as the key owner through HTTP Signature. The exploitation bypasses API token scope checks, converting a user-scoped token into an unscoped API authentication method, while still adhering to the account's role and repository permissions.
Users can upgrade to Gitea version 1.27.2, which addresses this vulnerability by restoring the proper API token scope checks. Instructions for upgrading are available in the Gitea documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://blog.gitea.com/release-of-1.27.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38862 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/38895 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65 | Gitea Limited | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | Gitea Limited |
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= v1.26.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |