VDB
CVE-2026-73804
CVE-2026-73804
PUBLISHED
CVSS 8.1 HIGH
Reported by Gitea · Published October 14, 2026
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
Risk Scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
| Gitea | Gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 15, 2026 EPSS Score
- Oct 18, 2026 CVE Updated
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Nov 3, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-q55v-4cmj-xh65 vendor-advisory
- Gitea 1.27.2 release announcement release-notes
- Fix: go-gitea/gitea pull request #38862 patch
- Fix: go-gitea/gitea pull request #38895 patch
- go-gitea/gitea v1.27.2 release release-notes