CVE-2026-73804: Gitea API token scope escalation through HTTP signatures

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-18
Weakness: CWE-266

Description

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

Affected products

Gitea Open Source Git Server: through 1.26.4

References

https://blog.gitea.com/release-of-1.27.2/
https://github.com/go-gitea/gitea/pull/38862
https://github.com/go-gitea/gitea/pull/38895
https://github.com/go-gitea/gitea/releases/tag/v1.27.2
https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65
https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65

Get alerted when CVE-2026-73804 or the next vulnerability affects your stack