Executive brief
Gitea, a popular self-hosted Git service, contains a flaw where users who have been manually deactivated by an administrator can reactivate their own accounts. By simply signing in again through an external provider like GitHub, the system incorrectly identifies the account as one that should be automatically restored. This allows unauthorized users to regain access to their data and potentially maintain administrative privileges if they previously held them.
Technical details
An authorization bypass exists in Gitea's OAuth2 sign-in callback logic within `routers/web/auth/oauth.go`. The application attempts to distinguish between accounts deactivated by an administrator and those disabled by an auto-sync cron job by checking if the stored `RefreshToken` is empty. However, for providers like GitHub or OIDC sources without `offline_access`, the refresh token is always empty. Consequently, when a deactivated user authenticates via these providers, Gitea incorrectly identifies them as eligible for auto-reactivation and sets `IsActive=true`. This allows deactivated users to regain full session access, including administrative rights if applicable, provided they can still authenticate with the external provider. The issue is resolved in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: patched: Version 1.27.0 released
- 2026-07-21: advisory: GitHub Advisory published