The vulnerability allows an OAuth2 sign‑in flow to inadvertently re‑activate user accounts that have been consciously disabled by an administrator. Because the flaw occurs in auth sources that lack refresh tokens, a malicious OAuth2 attacker can trigger a reactivation, thereby granting the account active access to the Git server. This could lead to unauthorized access to repositories, project resources, and potentially sensitive code. The weakness involves compromised access control (CWE‑863) and improper authorization logic (CWE‑807).

Gitea Open Source Git Server is the targeted product. The issue affects installations that use OAuth2 authentication without refresh tokens. No specific version range is identified in the CNA data, but the advisory references the 1.27.0 release, which contains an incomplete fix for issue #38009.

The CVE has a CVSS score of 8.1, indicating a high severity level. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely through the normal OAuth2 sign‑in process; any entity that can provide valid OAuth2 credentials could exercise the reactivation logic. Because deactivated accounts normally deny all activity, the ability to reactivate them represents a full privilege escalation for the attacker.