Gitea API token scope escalation through HTTP signatures
Summary
| CVE | CVE-2026-73804 |
|---|---|
| State | PUBLISHED |
| Assigner | Gitea |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 15:17:24 UTC |
| Updated | 2026-10-14 16:04:39 UTC |
| Description | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions. |
Risk And Classification
Problem Types: CWE-266 | CWE-863 | CWE-266 CWE-266: Incorrect Privilege Assignment | CWE-863 CWE-863: Incorrect Authorization
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| blog.gitea.com/release-of-1.27.2 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | blog.gitea.com | |
| github.com/go-gitea/gitea/pull/38895 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/releases/tag/v1.27.2 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/38862 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: https://github.com/ohxorud-dev (en)
CNA: https://github.com/bircni (en)
CNA: https://github.com/lunny (en)
CNA: https://github.com/delvh (en)
CNA: https://github.com/wxiaoguang (en)
CNA: https://github.com/TheFox0x7 (en)
There are currently no legacy QID mappings associated with this CVE.