CVE-2026-96404

Summary

Gitea's web installer fails to verify passwords when creating admin sessions for existing accounts, allowing attackers to gain full administrative access without knowing the password. This affects installations where the INSTALL_LOCK flag was reset to false.

Exploitability

Moderately difficult to exploit as it requires access to a database with existing users and knowledge of an administrator's username, but can be automated once the precondition is met.

Blast radius

High impact in environments with multiple administrators or single-user databases where attackers could gain full control over Gitea installations without needing valid credentials.

Detection

Monitor for failed login attempts followed by successful admin session creation in the application logs, particularly when the installer form is submitted against databases with existing users.

Prioritized remediation

Upgrade to Gitea version 2.590 or later to fix the authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.