CVE-2026-96404

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Improper Authentication pada gitea. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2 exploit · mitigasi · advisory vendor
• https://github.com/go-gitea/gitea/pull/39400 patch
• https://blog.gitea.com/release-of-28.0.0/ release notes
• https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release notes