Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-58422 · Microsoft / collected KEV context

EUVD-2026-41605

GHSA-g9g6-qhrc-p3qc

GO-2026-6056

cve-program · CVE-2026-58422

• https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc
• https://github.com/go-gitea/gitea/pull/38009
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

euvd · EUVD-2026-41605

• https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc
• https://github.com/go-gitea/gitea/pull/38009
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

nvd · CVE-2026-58422

• https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
• https://github.com/go-gitea/gitea/pull/38009
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4
• https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc

osv · GHSA-g9g6-qhrc-p3qc

• https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc
• https://nvd.nist.gov/vuln/detail/CVE-2026-58422
• https://github.com/go-gitea/gitea/pull/38009
• https://github.com/go-gitea/gitea/commit/c43eb7c33a100ffc7b2367adf165f7085e0ccdc5
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4
• https://github.com/go-gitea/gitea
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4

osv · GO-2026-6056

• https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc
• https://nvd.nist.gov/vuln/detail/CVE-2026-58422
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4
• https://github.com/go-gitea/gitea/commit/c43eb7c33a100ffc7b2367adf165f7085e0ccdc5
• https://github.com/go-gitea/gitea/pull/38009
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4

No related operational record is retained in the current change model.