CVE-2026-120263 Gitea CVE debrief

Who should care

Defenders who manage Gitea instances should assess exposure and verify the configuration of OAuth2 clients. They should also review user accounts and their linked external identities to prevent unauthorized access.

Why it matters

CVE-2026-120263 is a vulnerability in Gitea that allows an attacker to link their external identity to an existing Gitea account and sign in as that user without their password, including as an administrator. Defenders should prioritize verifying the configuration of OAuth2 clients and reviewing user accounts to prevent unauthorized access.

• An attacker could sign in as an administrator without a password.
• An attacker could link their external identity to an existing Gitea account and sign in without a password.
• Defenders need to verify the configuration of OAuth2 clients and review user accounts to prevent unauthorized access.

Technical summary

The vulnerability occurs when `[oauth2_client].ACCOUNT_LINKING` is set to `auto` and registration is enabled. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.

Defensive priority

Defenders should prioritize verifying the configuration of OAuth2 clients in Gitea and ensuring that account linking is not set to auto. They should also review user accounts and their linked external identities to prevent unauthorized access.

Recommended defensive actions

• Verify the configuration of OAuth2 clients in Gitea and ensure that account linking is not set to auto.
• Review user accounts and their linked external identities to prevent unauthorized access.
• Update Gitea to version 28.3.0 or later to apply the fix.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by an unknown source and is described in the Gitea security advisory GHSA-8p3x-w464-4g6v. The CVE record was created on 2026-11-01T10:18:37.520Z. Defenders should verify the configuration of OAuth2 clients and review user accounts to prevent unauthorized access. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required. Evidence is limited; defenders should take

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.