# CVE-2026-120263: Gitea account takeover via OAuth2 auto-linking

Source: https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120263 · Severity: info · Published 2026-11-01

Gitea is a self-hosted Git service that allows users to authenticate via OAuth2 providers. When auto-account linking is enabled (non-default), an attacker with an account on any configured OAuth2 provider could sign up, enter an existing Gitea user's name or email, and gain access to that account without knowing its password—including administrator accounts. The attacker's external identity would persist, allowing unauthorized access on subsequent logins.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea).

## Quick answers

**Is CVE-2026-120263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120263 being exploited in the wild.

**How severe is CVE-2026-120263?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Gitea prior to 28.3.0.

**Is there a fix for CVE-2026-120263?** Yes: fixed in Gitea 28.3.0. Until then: Disable OAuth2 auto-account linking by setting [oauth2_client].ACCOUNT_LINKING to a value other than `auto`, or disable user registration until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120263?** Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Gitea 28.3.0

Disable OAuth2 auto-account linking by setting [oauth2_client].ACCOUNT_LINKING to a value other than `auto`, or disable user registration until upgrading.

## Technical details

When ACCOUNT_LINKING is set to `auto` and registration is enabled, the OAuth2 link-account sign-up form was using submitted user names or emails to identify which existing account to link, rather than validating that the submitted credentials matched the identity asserted by the OAuth2 provider. An attacker could exploit this by submitting another user's name or email on the linking form, causing the external identity to be linked to and signed in as that victim account without password verification. The fix restricts automatic linking to cases where the external identity's email or derived user name matches the existing account.

## Affected products

- Gitea Gitea prior to 28.3.0

## Timeline

- 2026-11-01: disclosed
- 2026-11-01: patched

## References

- [https://blog.gitea.com/release-of-28.3.0/](https://blog.gitea.com/release-of-28.3.0/)
- [https://github.com/go-gitea/gitea/pull/40121](https://github.com/go-gitea/gitea/pull/40121)

## Related threats

- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)
- [Gitea REST API archived repository modification bypass](https://junglewise.ai/threats/cve-2026-118504-the-web-interface-blocks-issue-and-pull-request-changes-on)