Gitea allows an attacker who possesses a token with the write:user scope to register a malicious SSH account. Subsequent API requests signed with the corresponding private key authenticate as that account through HTTP Signature, bypassing the token scope checks normally performed on each route. This effectively converts a user‑scoped token into an unscoped authentication method while preserving the account’s normal role and repository permissions.

Gitea deployments running any version prior to 1.27.2 are vulnerable. The advisory indicates that the fix is included in release 1.27.2, so updating to this or a later version protects against the flaw.

EPSS indicates a very low exploitation probability (<1%) and the vulnerability is not listed in KEV. However, the missing scope enforcement can still lead to severe privilege escalation if an attacker obtains a write:user token, enabling them to perform any API action authorized for that account.