{"id":"CVE-2026-96404","published":"2026-10-06T20:17:35.500","lastModified":"2026-10-07T15:17:58.800","description":"When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39400","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39400","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2","tags":[]}],"hasPoc":true,"ai":{"summary":"Gitea's web installer fails to verify passwords when creating admin sessions for existing accounts, allowing attackers to gain full administrative access without knowing the password. This affects installations where the INSTALL_LOCK flag was reset to false.","exploitability":"Moderately difficult to exploit as it requires access to a database with existing users and knowledge of an administrator's username, but can be automated once the precondition is met.","blast_radius":"High impact in environments with multiple administrators or single-user databases where attackers could gain full control over Gitea installations without needing valid credentials.","remediation":"Upgrade to Gitea version 2.590 or later to fix the authentication bypass vulnerability.","detection":"Monitor for failed login attempts followed by successful admin session creation in the application logs, particularly when the installer form is submitted against databases with existing users.","tags":["auth-bypass","web","installer","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:57.806Z"}}