Vulnerability advisory
GO-2026-6078
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) in gitea.dev
Also known as CVE-2026-55987GHSA-vrhc-jjfc-m3m3
Severity
Severity not reported.
Affected versions
gitea.dev Go
| Affected | Fixed in |
|---|---|
| All versions before 1.27.0 | 1.27.0 |
Description
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) in gitea.dev