CVE-2026-73804
Gitea API token scope escalation through HTTP signatures
- State
- Published
- Severity
- 8.1 High
- Published
- Oct 14, 2026
- Updated
- Oct 18, 2026
- Reserved
- Aug 13, 2026
Description
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
GiteaGitea |
|
References
- GitHub Security Advisory GHSA-q55v-4cmj-xh65vendor-advisory
- Gitea 1.27.2 release announcementrelease-notes
- Fix: go-gitea/gitea pull request #38862patch
- Fix: go-gitea/gitea pull request #38895patch
- go-gitea/gitea v1.27.2 releaserelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.