CVE-2026-96404
Gitea: authentication bypass
- Risk score
- 66/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL_LOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the acc…
- Affected
- Gitea
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…
The flaws
- CVE-2026-96404: Authentication bypass (CVSS 8.1 · EPSS 0%)
- CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
- CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
- CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Gitea
Where it stands
- Exploited in the wild
- On CISA's exploited list since 25 Aug
- US federal deadline 28 Aug
How it unfolded
- 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
- 28 Aug, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: Authentication bypass (CWE-287). 236 other warnings in 30 days
- Same product: Earlier Gitea warnings. 25 in the last 90 days
Why it is Amber
- CVSS 8.1 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
References
Original description
When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.
Last activity 6 Oct 2026. Patch Forecast updates every hour.