CVE-2026-55987

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An issue exists in the OAuth2 sign-in callback that allows a deactivated user account to be reactivated when signing in through an authentication source that does not issue refresh tokens, such as GitHub or OIDC/OAuth2 sources configured without offline access. The system incorrectly uses an empty refresh token as a signal that an account was disabled by the auto-sync cron rather than by an administrator. Consequently, when a deactivated user signs in via these providers, the system sets IsActive to true and grants a full session, bypassing the administrator's deactivation. This affects the handleOAuth2SignIn function within routers/web/auth/oauth.go. If the deactivated account had administrative privileges, those privileges are also restored. This does not affect accounts disabled via the Prohibit Login feature.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.