EUVD-2026-41605

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

CVE-2026-58422

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

CVE-2026-58422

Gitea version 1.26.1 is vulnerable to an improper authorization flaw in the OAuth2 sign-in callback. The handler in routers/web/auth/oauth.go fails to treat the local IsActive flag as an authoritative administrative override; instead, it treats it as stale data and automatically re-enables accoun...

CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

CVE-2026-58422

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...