# CVE-2026-55987: Gitea account deactivation bypass via OAuth2 sign-in

Source: https://junglewise.ai/threats/cve-2026-55987-gitea-account-deactivation-bypass-via-oauth2-sign-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-55987 · Severity: high · CVSS 8.1 · Published 2026-07-21

Gitea, a popular self-hosted Git service, contains a flaw where users who have been manually deactivated by an administrator can reactivate their own accounts. By simply signing in again through an external provider like GitHub, the system incorrectly identifies the account as one that should be automatically restored. This allows unauthorized users to regain access to their data and potentially maintain administrative privileges if they previously held them.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [gitea.dev (Go)](https://junglewise.ai/threats/technologies/gitea-dev). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55987 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55987 being exploited in the wild.

**How severe is CVE-2026-55987?** High severity, with a CVSS score of 8.1, published 21 July 2026.

**Which products and versions are affected?** Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

**Is there a fix for CVE-2026-55987?** Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55987 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55987?** Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.27.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.27.0
  ```

- gitea.dev (Go): upgrade to 1.27.0 or later

  ```sh
  go get gitea.dev@v1.27.0
  ```


## Technical details

An authorization bypass exists in Gitea's OAuth2 sign-in callback logic within `routers/web/auth/oauth.go`. The application attempts to distinguish between accounts deactivated by an administrator and those disabled by an auto-sync cron job by checking if the stored `RefreshToken` is empty. However, for providers like GitHub or OIDC sources without `offline_access`, the refresh token is always empty. Consequently, when a deactivated user authenticates via these providers, Gitea incorrectly identifies them as eligible for auto-reactivation and sets `IsActive=true`. This allows deactivated users to regain full session access, including administrative rights if applicable, provided they can still authenticate with the external provider. The issue is resolved in version 1.27.0.

## Affected products

- Gitea Gitea < 1.27.0

## Identifiers

- CVE-2026-55987
- GHSA-vrhc-jjfc-m3m3
- GO-2026-6078

## Timeline

- 2026-07-13: patched: Version 1.27.0 released
- 2026-07-21: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/khoadb175](https://api.github.com/users/khoadb175)
- [https://github.com/khoadb175](https://github.com/khoadb175)
- [https://api.github.com/users/khoadb175/gists%7B/gist_id%7D](https://api.github.com/users/khoadb175/gists%7B/gist_id%7D)
- [https://api.github.com/users/khoadb175/repos](https://api.github.com/users/khoadb175/repos)
- [https://avatars.githubusercontent.com/u/97925674?v=4](https://avatars.githubusercontent.com/u/97925674?v=4)
- [https://api.github.com/users/khoadb175/events%7B/privacy%7D](https://api.github.com/users/khoadb175/events%7B/privacy%7D)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)