CVE-2026-55987
published 2026-08-13CVE-2026-55987: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
PriorityP347high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.29%
22.2th percentile
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Administrator-deactivated accounts can be reactivated via OAuth2 sign-in
vendor_redhat·2026-08-13·CVSS 8.1
CVE-2026-55987 [HIGH] CWE-807 code.gitea.io/gitea: Gitea: Administrator-deactivated accounts can be reactivated via OAuth2 sign-in
code.gitea.io/gitea: Gitea: Administrator-deactivated accounts can be reactivated via OAuth2 sign-in
A flaw was found in Gitea. An attacker can reactivate an administrator-deactivated account by signing in via OAuth2, specifically when using authentication sources that do not utilize refresh tokens. This bypasses intended security controls, allowing unauthorized access to previously deactivated accounts.
Package: openshift-pipelines-client (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-cli-tkn-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-opc-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipe
GHSA
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
ghsa·2026-07-21
CVE-2026-55987 [HIGH] CWE-863 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
## Description
Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authentication source that does not issue refresh tokens (notably GitHub, and any OIDC/OAuth2 source configured without `offline_access`). PR #38009 added a gate intended to reactivate users only when the OAuth2 auto-sync cron had disabled them, using "the stored refresh token is empty" as the signal. That signal is wrong: for sources that never issue refresh tokens, an empty refresh token is the normal state of every user, so the gate cannot distinguish a cron-disabled account from one an administrator deliberately
No detection rules found.
No public exploits indexed.
2026-08-13
Published