CVE-2026-58422 Gitea CVE debrief

Who should care

Gitea administrators and security teams should assess exposure and verify remediation due to the critical severity of this authorization vulnerability. Gitea deployments are at risk, and defenders should prioritize verifying and remediating this issue to prevent potential unauthorized account access. Security teams should review and remediate this issue to prevent potential unauthorized account access.

Why it matters

CVE-2026-58422 is a critical vulnerability in Gitea's OAuth sign-in callback that allows silent re-enablement of administrator-disabled accounts. Gitea administrators should verify and remediate this issue to prevent potential unauthorized account access.

• Potential unauthorized account re-enablement
• Required verification of Gitea version and administrator account status
• Possible impact on administrator account management

Technical summary

The vulnerability allows an attacker to silently re-enable administrator-disabled accounts via the OAuth sign-in callback. This issue is addressed in Gitea version 1.26.4. Gitea administrators and security teams should assess exposure and verify remediation due to the critical severity of this authorization vulnerability. The vulnerability poses a critical risk to Gitea deployments, and defenders should prioritize verifying and remediating this issue to prevent potential unauthorized account access. The fix in version 1.26.4 addresses the improper authorization vulnerability.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in Gitea deployments where administrator account management is critical.

Recommended defensive actions

• Verify Gitea deployments for version 1.26.4 or later
• Review administrator-disabled accounts for unexpected re-enablement
• Implement additional monitoring for OAuth sign-in callback activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the improper authorization vulnerability in Gitea's OAuth sign-in callback. Vendor sources indicate a fix in version 1.26.4. This issue allows silent re-enablement of administrator-disabled accounts, posing a critical risk to Gitea deployments. Defenders should verify Gitea version and administrator account status, and implement additional monitoring for OAuth sign-in callback activity. The vulnerability has been addressed, and Gitea administrators should review and remediate this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.