Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. code.gitea.io/gitea
  4. ›
  5. CVE-2026-56750

CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session

July 21, 2026

The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch).

The vulnerable function is this one:

https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64

References

  • github.com/advisories/GHSA-rgv6-xp99-6mgj
  • github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
  • github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
  • github.com/go-gitea/gitea/pull/38406
  • github.com/go-gitea/gitea/pull/38426
  • github.com/go-gitea/gitea/releases/tag/v1.27.0
  • github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj
  • nvd.nist.gov/vuln/detail/CVE-2026-56750

Code Behaviors & Features

Detect and mitigate CVE-2026-56750 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.27.0

Fixed versions

  • 1.27.0

Solution

Upgrade to version 1.27.0 or above.

Impact 9.1 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-613: Insufficient Session Expiration

Source file

go/code.gitea.io/gitea/CVE-2026-56750.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 08 Aug 2026 00:18:14 +0000.