Improper access control in Gitea - CVE-2026-55986
Published: July 14, 2026
Vulnerability identifier: #VU137428
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55986
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass administrator-imposed credential management restrictions.
The vulnerability exists due to improper access control in the user email management API endpoints in routers/api/v1/user/email.go when handling requests to add or remove email addresses. A remote user can send crafted API requests to bypass administrator-imposed credential management restrictions.
The issue affects externally authenticated users when credential management is disabled for their authentication type, and the web interface enforces the restriction while the API does not.
Affected software
Gitea
How to mitigate CVE-2026-55986
Install security update from vendor's website.
Gitea - update to 1.27.0