A high-severity authentication bypass vulnerability in Gitea allows previously deactivated user accounts to be reactivated, posing a significant risk to organizational access control.

This vulnerability is an instance of CWE-863 (Incorrect Authorization), where the OAuth2 authentication flow fails to respect the deactivated state of a user account. An authenticated user can trigger this flaw to regain access to a system that was restricted by an administrator.

The ability for a deactivated user to reactivate their own account constitutes a severe failure of identity and access management controls. Given the CVSS score of 8.1, this vulnerability poses a high risk to data confidentiality and integrity, as unauthorized users could regain access to sensitive source code repositories and project management data. Failure to remediate could lead to unauthorized data exfiltration or continued malicious activity by accounts intended to be locked out of the system.

Immediate Action: Update Gitea to version 1.27.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Audit user account management logs for unexpected account activations or logins from users previously flagged as deactivated.

Compensating Controls: Review OAuth2 provider configurations and restrict access to external authentication sources to only verified, trusted users until the patch is applied.

Public Exploit Available: Unknown.

Organizations utilizing Gitea should prioritize the upgrade to version 1.27.0 immediately. Because this vulnerability involves a bypass of administrative account control, it represents a critical threat to the integrity of the development environment and internal access policies. Ensure all instances are identified and patched to prevent unauthorized access by deactivated accounts.