Bug 2552365 (CVE-2026-73804)

Summary:	CVE-2026-73804 code.gitea.io/gitea: Gitea: Privilege escalation via API token scope bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gbenhaim, niyer, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Gitea. An authenticated attacker with a restricted user-level Application Programming Interface (API) token can achieve privilege escalation by registering an arbitrary Secure Shell (SSH) public key to the account. Subsequent API requests signed with the corresponding private key bypass route-level token scope checks because HTTP (Hypertext Transfer Protocol) signature authentication does not enforce token restrictions. This flaw allows an attacker to perform unauthorized actions with the full permissions of the underlying account.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-14 14:53:32 UTC

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.