---
id: CVE-2026-73804
title: >-
  Gitea allows a token with write:user scope to register an attacker-controlled
  SSH public key on the token owner's account
summary: >-
  Gitea allows a token with write:user scope to register an attacker-controlled
  SSH public key on the token owner's account. API requests signed with the
  corresponding private key authenticate as that account through HTTP Signature
  without…
severity: none
cwe:
  - CWE-266
  - CWE-863
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:04:39.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73804'
references:
  - url: 'https://blog.gitea.com/release-of-1.27.2/'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/38862'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/38895'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.27.2'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T15:36:14.031Z'
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev <= 1.26.4
---

## Overview

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.