CVE-2026-73804

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-266 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-738079.8The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with ne CVE-2026-738097.5A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does CVE-2026-73819.1Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allo CVE-2026-738128.3httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 CVE-2026-738146.5Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. Th CVE-2026-738199.8The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's ide CVE-2026-73826.5Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability CVE-2026-738274.8SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is loggin CVE-2026-738293.7Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain pa CVE-2026-73838.1Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap b CVE-2026-738345.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources th CVE-2026-738394.6Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential c