Based on the description, it is inferred that an attacker who possesses OAuth credentials for a previously disabled account could trigger a re‑enable. The flaw is an improper authorization weakness (CWE‑284). When triggered, the system silently changes the account state back to active, granting all privileges of a former administrator. The impact is a full elevation of rights to administrative functions and potential compromise of all data managed by the instance.

Installations of the Gitea Open Source Git Server that use the vulnerable OAuth sign‑in logic are affected. No specific version constraints were provided by the CNA data; any deployment that relies on the OAuth callback may be impacted, including older releases that have not been patched to the release of 1.26.4.

The CVSS score of 9.8 marks this defect as critical. Its EPSS score of < 1% denotes a very low probability of exploitation, yet the potential to regain administrative privileges makes it a high‑risk security concern. Because the vulnerability is not listed in the CISA KEV catalog, no known public exploits have been reported, but the attack path—obtaining OAuth credentials for a disabled account and visiting the callback URL—remains feasible for remote attackers who have compromised user credentials.