Is CVE-2026-55987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55987 being exploited in the wild.

How severe is CVE-2026-55987?

High severity, with a CVSS score of 8.1, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-55987?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55987 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55987?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55987: Gitea account deactivation bypass via OAuth2 sign-in

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-55987?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55987 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55987?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55987 · Severity: high · CVSS 8.1 · Published 2026-07-21

Gitea, a popular self-hosted Git service, contains a flaw where users who have been manually deactivated by an administrator can reactivate their own accounts. By simply signing in again through an external provider like GitHub, the system incorrectly identifies the account as one that should be automatically restored. This allows unauthorized users to regain access to their data and potentially maintain administrative privileges if they previously held them.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-55987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55987 being exploited in the wild.
How severe is CVE-2026-55987?: High severity, with a CVSS score of 8.1, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-55987?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55987 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55987?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

An authorization bypass exists in Gitea's OAuth2 sign-in callback logic within `routers/web/auth/oauth.go`. The application attempts to distinguish between accounts deactivated by an administrator and those disabled by an auto-sync cron job by checking if the stored `RefreshToken` is empty. However, for providers like GitHub or OIDC sources without `offline_access`, the refresh token is always empty. Consequently, when a deactivated user authenticates via these providers, Gitea incorrectly identifies them as eligible for auto-reactivation and sets `IsActive=true`. This allows deactivated users to regain full session access, including administrative rights if applicable, provided they can still authenticate with the external provider. The issue is resolved in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-55987
GHSA-vrhc-jjfc-m3m3
GO-2026-6078

Timeline

2026-07-13: patched: Version 1.27.0 released
2026-07-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.