Executive brief
A security flaw in Gitea allows users whose accounts have been disabled by an administrator to regain full access to the system. By logging in through a linked external service like GitHub or Google, the disabled status is automatically and silently removed. This allows unauthorized individuals, such as former employees or compromised accounts, to continue accessing private code repositories and organizational data.
Technical details
An improper authorization vulnerability exists in Gitea's OAuth2 callback handler at `/user/oauth2/{source-name}/callback`. When a user authenticates via an external identity provider (IdP), the `handleOAuth2SignIn` function in `routers/web/auth/oauth.go` checks the local `IsActive` flag; if it is false, the code explicitly sets it to true and updates the database before establishing the session. This behavior bypasses administrative 'Disable Account' actions, as the middleware check for active status occurs after the flag has been flipped back to true. An attacker with a previously linked IdP can exploit this to regain full read/write access to repositories and organizations. The issue is resolved in version 1.26.4.
Affected products
- Gitea Gitea < 1.26.4
Timeline
- 2026-07-01: disclosed
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-03: other: NVD published