CVE-2026-55987 in Gitea
Summary
by MITRE • 08/13/2026
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authentication bypass flaw in systems that utilize OAuth2 for user authentication, specifically affecting scenarios where administrator-deactivated accounts are reactivated without proper token validation. The issue stems from an incomplete remediation of a previously identified vulnerability numbered #38009, indicating that while efforts were made to address account deactivation controls, the solution failed to fully resolve the underlying security gap. The flaw manifests when OAuth2 authentication sources fail to properly validate the account status during sign-in processes, allowing deactivated administrator accounts to be automatically reactivated upon successful authentication attempts.
The technical implementation of this vulnerability occurs within the authentication flow where the system accepts valid OAuth2 tokens without verifying whether the associated account remains active or has been administratively disabled. This creates a condition where even accounts that have been explicitly deactivated by system administrators can regain access through legitimate authentication channels, effectively bypassing account management controls that are fundamental to security governance. The absence of refresh token validation in this process compounds the issue, as the system does not maintain proper session state awareness regarding account deactivation status.
From an operational impact perspective, this vulnerability undermines core security controls by enabling unauthorized access to privileged accounts that should have been disabled. Administrators who rely on account deactivation as a security measure for users who no longer require access or who have violated security policies can have their controls circumvented. The risk is particularly elevated in environments where administrator accounts possess extensive privileges, as compromised or rogue accounts could be reactivated without proper oversight, potentially leading to privilege escalation and unauthorized system access.
Security frameworks such as CWE-613 identify this as an inadequate authentication flow control issue, specifically related to insufficient account deactivation validation during authentication processes. The vulnerability aligns with ATT&CK technique T1566 which covers credential harvesting through social engineering or legitimate access points, as it allows attackers to leverage valid authentication tokens to bypass account management controls. Organizations implementing this authentication pattern without proper token lifecycle management create opportunities for attackers to exploit the gap between authentication and authorization validation steps.
Mitigation strategies should focus on implementing comprehensive account status verification during all authentication flows, particularly for OAuth2 integrations. Systems must validate account deactivation status against the authentication source before granting access, regardless of token validity. The implementation should include mandatory account status checks that occur prior to token acceptance, ensuring that deactivated accounts cannot be reactivated through authentication processes. Additionally, organizations should implement proper session management with refresh token validation that includes account state verification and establish monitoring controls to detect unauthorized account reactivations. This approach addresses both the immediate vulnerability and prevents similar issues from arising in other authentication pathways.