In Gitea versions before 1.27.0, a flaw exists in the OAuth2 sign-in logic where accounts deactivated by administrators can be reactivated if the authentication source does not provide refresh tokens (such as GitHub or OIDC/OAuth2 without offline_access). The system incorrectly interprets an empty refresh token as a trigger to reactivate the account, enabling users who were deactivated to regain active status and full session access simply by signing in again. This vulnerability does not affect accounts disabled using the stronger "Prohibit Login" setting. The issue is tracked as CVE-2026-55987 and has a CVSS 3.1 score of 8.1 (high severity). A patch is available in Gitea 1.27.0 to fix this incomplete prior fix.

Deactivated user accounts can be reactivated by simply signing in again via OAuth2 if the authentication source does not issue refresh tokens, bypassing administrator deactivation controls. This results in unauthorized access with full session privileges for those accounts. The vulnerability does not affect accounts disabled with the "Prohibit Login" setting. There are no known exploits in the wild at this time.

A patch is available in Gitea version 1.27.0 that fixes this vulnerability. Users should upgrade to version 1.27.0 or later to remediate the issue. Until patched, administrators can use the "Prohibit Login" setting to disable accounts more securely, as this setting is not affected by the vulnerability.