CVE-2026-96404

An IMPORTANT severity authentication bypass flaw was found in Gitea. When the Gitea web installer is reachable against a database that already contains users, such as after INSTALL_LOCK has been reset to false, an unauthenticated remote attacker can submit the installation form specifying an existing administrator username, and the application issues an authenticated session for that account without verifying its password. If the account is an administrator, the attacker obtains full administrative access to the instance, including the ability to change the account's password; databases containing a single user also did not require the reinstall confirmation. Red Hat rates this flaw IMPORTANT with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), matching the upstream CISA severity; the high attack complexity reflects that exploitation requires the uncommon condition of the web installer being exposed against an already-populated database. Within Red Hat products, the affected Gitea component is bundled in Konflux Pipelines as Code container images (pipelines-pipelines-as-code-controller-rhel9 and pipelines-pipelines-as-code-watcher-rhel9). These are tracked as affected with the resolution delegated, and a fix is being pursued through the responsible update stream.