The vulnerability CVE-2026-58422 affects Gitea Open Source Git Server and involves improper authorization during the OAuth sign-in callback process. Specifically, accounts that have been disabled by an administrator can be re-enabled without proper authorization checks, potentially allowing unauthorized access. The vulnerability is categorized under CWE-284 (Improper Access Control). There is no CVSS score or detailed vendor advisory available, and no known exploits in the wild have been reported.

The impact of this vulnerability is that administrator-disabled accounts may be reactivated without authorization, potentially allowing users who should be blocked from accessing the system to regain access. This could undermine administrative controls and lead to unauthorized access to the Git server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Administrators should monitor vendor communications for updates and consider additional access controls or monitoring until a fix is released.