https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:01:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333341 EUVD-2026-333341 https://cve.radiocsirt.org/vuln/euvd-2026-333341 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58422 <p>Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts</p> <p>Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58422 https://cve.radiocsirt.org/vuln/ghsa-g9g6-qhrc-p3qc <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated `Disable Account` action and issuing a fresh authenticated session in the same response. Once a user has linked any external IdP, the administrator&#39;s disable toggle becomes non-binding — the user can re-enable themselves on demand by completing one OAuth callback, regaining full read and write access to their repositories, organizations, and access tokens.</p> <p>### Details</p> <p>Improper Authorization is present on the `code` and `state` parameters of the `/user/oauth2/{source-name}/callback` endpoint in Gitea version 1.26.1. The handler `routers/web/auth/oauth.go::handleOAuth2SignIn` reads the local user&#39;s `IsActive` flag at lines 350-352 and, when it is `false`, sets `opts.IsActive = optional.Some(true)` before calling `user_service.UpdateUser` and immediately establishing a session. The active-state precondition that the request middleware `routers/web/web.go::verifyAuthWithOptions` enforces for every other request is therefore evaluated against the freshly-flipped row on the next request, so a site administrator&#39;s &#34;disable user&#34; action is silently undone the next time the user authenticates through any linked external identity provider.</p> <p>The root cause is that the callback path treats the local `IsActive` flag as stale bookkeeping to reconcile against…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated `Disable Account` action and issuing a fresh authenticated session in the same response. Once a user has linked any external IdP, the administrator&#39;s disable toggle becomes non-binding — the user can re-enable themselves on demand by completing one OAuth callback, regaining full read and write access to their repositories, organizations, and access tokens.</p> <p>### Details</p> <p>Improper Authorization is present on the `code` and `state` parameters of the `/user/oauth2/{source-name}/callback` endpoint in Gitea version 1.26.1. The handler `routers/web/auth/oauth.go::handleOAuth2SignIn` reads the local user&#39;s `IsActive` flag at lines 350-352 and, when it is `false`, sets `opts.IsActive = optional.Some(true)` before calling `user_service.UpdateUser` and immediately establishing a session. The active-state precondition that the request middleware `routers/web/web.go::verifyAuthWithOptions` enforces for every other request is therefore evaluated against the freshly-flipped row on the next request, so a site administrator&#39;s &#34;disable user&#34; action is silently undone the next time the user authenticates through any linked external identity provider.</p> <p>The root cause is that the callback path treats the local `IsActive` flag as stale bookkeeping to reconcile against…</p> https://cve.radiocsirt.org/vuln/ghsa-g9g6-qhrc-p3qc https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149