Incorrect authorization in Gitea - CVE-2026-73804
Published: August 15, 2026
Vulnerability details
The vulnerability allows a remote user to bypass API token scope restrictions and perform unauthorized API actions.
The vulnerability exists due to incorrect authorization in HTTP Signature authentication and route-level scope enforcement when processing HTTP Signature-authenticated API requests created from a user-scoped token. A remote user can add an attacker-controlled SSH public key to the account and sign API requests to bypass API token scope restrictions and perform unauthorized API actions.
The resulting access is constrained by the compromised account\'s normal RBAC permissions, but API token scope checks are skipped because the request is marked as API-token authenticated without an associated scope.