CVE-2026-120263

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An issue exists when registration is enabled and the [oauth2 client].ACCOUNT LINKING setting is configured as auto. The link-account sign-up form identifies existing accounts to link based on the username or email provided in the form rather than the identity verified by the OAuth2 provider. This allows an attacker with a valid account on a configured OAuth2 provider to submit another user's name, link their external identity to that account, and gain unauthorized access without a password, potentially including administrative privileges. This link remains active for subsequent logins.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.