Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-73804Gitea API token scope escalation through HTTP signatures

High 8.1

In plain English

A high-severity incorrect authorization in Gitea from Gitea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.26.4

Weakness: CWE-266, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory GHSA-q55v-4cmj-xh65 vendor-advisory
Gitea 1.27.2 release announcement release-notes
Fix: go-gitea/gitea pull request #38862 patch
Fix: go-gitea/gitea pull request #38895 patch
go-gitea/gitea v1.27.2 release release-notes