CVE-2026-73804
Description
A flaw was found in Gitea. An authenticated attacker with a restricted user-level Application Programming Interface (API) token can achieve privilege escalation by registering an arbitrary Secure Shell (SSH) public key to the account. Subsequent API requests signed with the corresponding private key bypass route-level token scope checks because HTTP (Hypertext Transfer Protocol) signature authentication does not enforce token restrictions. This flaw allows an attacker to perform unauthorized actions with the full permissions of the underlying account.
Statement
This vulnerability is rated with an Important severity impact because possessing a scoped API token permits an attacker to circumvent assigned access restrictions and assume the target account's complete repository and administrative authority. Red Hat does not distribute the Gitea server, and integrations such as OpenShift Pipelines do not embed the vulnerable service-side authentication routines. Exploitation requires an authenticated attacker with pre-existing user-write token permissions on a target Gitea deployment.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
