CVE-2026-73804
highGitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account.
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://blog.gitea.com/release-of-1.27.2/ 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/38862 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/38895 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65 134c704f-9b21-4f2e-91b3-4a467353bcc0