CVE-2019-11576 — Vulnerability in code.gitea.io/gitea — CVE Details

CRITICAL

Gitea Allows 1FA Even for 2FA-Enrolled Accounts

Published May 24, 2022Updated April 24, 2024Source: osv

Summary

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

Advisory Timeline

First published May 24, 2022 (1602 days ago).
Last revised April 24, 2024 — 701 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update code.gitea.io/gitea to 1.8.0 or later

go get code.gitea.io/gitea@v1.8.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
code.gitea.io/gitea	go	All versions	1.8.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-287
Improper AuthenticationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2019-11576?: Gitea Allows 1FA Even for 2FA-Enrolled Accounts This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2019-11576?: CVE-2019-11576 affects code.gitea.io/gitea. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-11576 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-3393-r4p5-vhqh

Related CVEs

CVE-2026-22874
CRITICAL
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
CVE-2024-6886
CRITICAL
Gitea Cross-site Scripting Vulnerability
CVE-2026-26232
CRITICAL
Gitea OAuth2 authorization codes can be reused after expiry
CVE-2026-27775
HIGH
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
CVE-2026-56654
HIGH
Gitea: Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-58424
HIGH
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-57894
HIGH
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
CVE-2026-27771
HIGH
Gitea has insufficient permission checks for Composer package source links

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies