Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120263— Gitea OAuth2 account auto-linking takeover through the sign-up form

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 设置为 （非默认值）且注册功能已启用时，关联账户的注册表单会依据表单中提交的用户名或电子邮件来查找待关联的现有账户，而非依据 OAuth2 提供商所声明的身份。若攻击者在已配置的 OAuth2 提供商上拥有账户，则可提交其他用户的用户名，将其外部身份与该 Gitea 账户关联，从而无需密码即可以该用户身份登录（包括以管理员身份登录）。该关联关系会持续存在，影响后续所有登录。现已修复：自动关联仅在现有账户的邮箱或从提供商推导出的用户名与 OAuth2 提供商提供的信息完全匹配时才会触发；否则，登录时仍需输入账户密

AI Predicted 8.8 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea < 28.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120263

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea OAuth2 account auto-linking takeover through the sign-up form
Source: CVE Program / CVE List V5
Vulnerability Description
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 28.3.0 -

II. Public POCs for CVE-2026-120263

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120263

请登录查看更多情报信息。

Other References for CVE-2026-120263 (5)

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649 Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit
CVE-2026-112887 Gitea Actions task token private repository enumeration
CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
CVE-2026-116296 Gitea archived repository release, milestone and label modification
CVE-2026-116474 Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635 Gitea admin API public-only token scope bypass
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677 Gitea Helm chart upload decompression denial of service
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
CVE-2026-118504 Gitea issue changes on archived repositories through the API
CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533 Gitea private pull request disclosure on project boards
CVE-2026-119625 Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-287