Gitea: API token scope bypass via SSH key registered with HTTP Signature
Summary
A user with a token that has only write:user scope can register an attacker-controlled SSH public key on their own account. Requests signed with the matching private key authenticate through HTTP Signature without the token scope, so route-level scope checks are skipped. The attacker keeps the account's normal role and repository permissions, so the scoped token effectively becomes unscoped API access. Exploitation requires a valid account with such a token.
Affected
- Gitea 1.26.4 and earlier, according to the CVE record (range not confirmed by the vendor)
- Gitea 1.27.0 and 1.27.1 (per vendor fix release 1.27.2)
Fixed in
- Gitea 1.27.2 (fixes via PRs #38862 and #38895)
- Gitea Cloud: 1.27.3
- Gitea Enterprise 27.3.0 (embeds 1.27.2)
Workaround
Unknown.
Exploitation
- Public exploit: none known
- CISA SSVC: exploitation status "poc", not automatable
- Not listed on CISA KEV in the sources reviewed
Our recommendation
- Update Gitea to 1.27.2 or later, or to the Gitea Cloud/Enterprise fix versions
- Review SSH keys on all accounts and remove unknown entries
- Limit who can create tokens with write:user scope
- Check whether the Gitea instance is reachable from the internet
- Monitor logs for new SSH keys and unusual API activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 1.27.2 is released blog.gitea.com
- Gitea release v1.27.2 github.com
- GitHub Security Advisory GHSA-q55v-4cmj-xh65 github.com
- Pull Request #38862 github.com
- Pull Request #38895 github.com
- OSV record CVE-2026-73804 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:06.
Original description (NVD)
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
NVD references (6)
- https://blog.gitea.com/release-of-1.27.2/
- https://github.com/go-gitea/gitea/pull/38862
- https://github.com/go-gitea/gitea/pull/38895
- https://github.com/go-gitea/gitea/releases/tag/v1.27.2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65
- https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.