Gitea: Authentication bypass in web installer for existing accounts
Summary
The Gitea web installer, when reachable against a database that already contains users (for example after INSTALL_LOCK was reset to false), accepts an administrator username that matches an existing account without verifying its password. An unauthenticated attacker who knows or guesses a valid username can obtain an authenticated session for that account. If the account is an administrator, the attacker gains full administrative access, including the ability to set a new password. Instances with a single existing user also skip the reinstall confirmation.
Affected
- Gitea up to and including 1.27.3 (according to the CVE record and a third-party aggregator; the exact range is not confirmed by the vendor in the sources reviewed)
- Versions before 28.0.0 should be treated as potentially affected until the vendor's version table is checked
Fixed in
- Gitea 28.0.0 (fix in PR #39400)
- Backports to 1.27.x: Unknown.
Workaround
- Keep INSTALL_LOCK set to true and do not leave the /install page reachable from the internet. This removes the precondition; it is a recommendation, not a vendor statement.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC in the CVE record: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Upgrade to Gitea 28.0.0 or later.
- Until patched, make sure INSTALL_LOCK is true and the installer is not reachable from the internet.
- Check whether any instance was restored, migrated or rebuilt with INSTALL_LOCK=false.
- Review administrator accounts and sessions for unexpected activity and change passwords where in doubt.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 28.0.0 release notes blog.gitea.com
- GitHub Security Advisory GHSA-9h7g-h754-c8x2 github.com
- Gitea v28.0.0 release tag github.com
- Gitea PR #39400 github.com
- OSV BIT-gitea-2026-96404 osv.dev
- OpenCVE CVE-2026-96404 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:42.
Original description (NVD)
When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.