CVE-2026-96404

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96404", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-10-04T21:59:53.548Z", "datePublished": "2026-10-06T19:25:28.457Z", "dateUpdated": "2026-10-07T14:26:56.170Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T19:25:28.457Z"}, "title": "Gitea installer authentication bypass for existing accounts", "descriptions": [{"lang": "en", "value": "When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.27.3", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2", "name": "GitHub Security Advisory GHSA-9h7g-h754-c8x2", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39400", "name": "Fix: go-gitea/gitea pull request #39400", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.0.0/", "name": "Gitea 28.0.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0", "name": "go-gitea/gitea v28.0.0 release", "tags": ["release-notes"]}], "credits": [{"lang": "en", "value": "https://github.com/vuductruong12", "type": "finder"}, {"lang": "en", "value": "https://github.com/lilmingwa13", "type": "analyst"}, {"lang": "en", "value": "https://github.com/wxiaoguang", "type": "remediation developer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T14:26:36.461394Z", "id": "CVE-2026-96404", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:26:56.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-96404", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T14:26:36.461394Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:26:18.879Z"}}], "cna": {"title": "Gitea installer authentication bypass for existing accounts", "credits": [{"lang": "en", "type": "finder", "value": "https://github.com/vuductruong12"}, {"lang": "en", "type": "analyst", "value": "https://github.com/lilmingwa13"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/wxiaoguang"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.27.3"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2", "name": "GitHub Security Advisory GHSA-9h7g-h754-c8x2", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39400", "name": "Fix: go-gitea/gitea pull request #39400", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.0.0/", "name": "Gitea 28.0.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0", "name": "go-gitea/gitea v28.0.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation."}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T19:25:28.457Z"}}}, "cveMetadata": {"cveId": "CVE-2026-96404", "state": "PUBLISHED", "dateUpdated": "2026-10-07T14:26:56.170Z", "dateReserved": "2026-10-04T21:59:53.548Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-06T19:25:28.457Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "1.27.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7A6F93E-7785-4553-A8BB-DA84ACFF76F0", "versionEndExcluding": "28.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation."}], "id": "CVE-2026-96404", "lastModified": "2026-10-13T15:36:13.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96404", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T14:26:36.461394Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:35.500", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://blog.gitea.com/release-of-28.0.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39400"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Authentication bypass via web installer", "id": "2547061", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547061"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-306", "details": ["When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.", "A flaw was found in Gitea. When the web installer is accessible against a database containing existing users, an unauthenticated remote attacker can submit the installation form specifying an existing administrator username. The application issues an authenticated session without verifying the account password, granting the attacker full administrative access to the instance."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-96404", "public_date": "2026-10-06T19:25:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96404\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96404\nhttps://blog.gitea.com/release-of-28.0.0/\nhttps://github.com/go-gitea/gitea/pull/39400\nhttps://github.com/go-gitea/gitea/releases/tag/v28.0.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2"], "statement": "An IMPORTANT severity authentication bypass flaw was found in Gitea. When the Gitea web installer is reachable against a database that already contains users, such as after INSTALL_LOCK has been reset to false, an unauthenticated remote attacker can submit the installation form specifying an existing administrator username, and the application issues an authenticated session for that account without verifying its password. If the account is an administrator, the attacker obtains full administrative access to the instance, including the ability to change the account's password; databases containing a single user also did not require the reinstall confirmation. Red Hat rates this flaw IMPORTANT with a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), matching the upstream CISA severity; the high attack complexity reflects that exploitation requires the uncommon condition of the web installer being exposed against an already-populated database. Within Red Hat products, the affected Gitea component is bundled in Konflux Pipelines as Code container images (pipelines-pipelines-as-code-controller-rhel9 and pipelines-pipelines-as-code-watcher-rhel9). These are tracked as affected with the resolution delegated, and a fix is being pursued through the responsible update stream.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.27.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea", "source": "cna", "vendor": "Gitea"}, "product": "gitea", "vendor": "gitea"}], "created": "2026-10-06T23:30:08.286960+00:00", "updated": "2026-10-17T09:45:06.183409+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea"]}