CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-55987

CVE-2026-55987 concerns Gitea’s OAuth2 sign-in, where administrator-deactivated accounts can be reactivated on auth sources that do not use refresh tokens. The root cause is described as deficiencies in access control related to OAuth2 sign-in, and it is an incomplete fix of issue #38009. Affecte...

CVE-2026-55987

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:27+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-vrhc-jjfc-m3m3...