CVE Catalog
CVE-2026-56750
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
Theft of the Remember-Me token in Gitea does not invalidate the attacker's session, allowing continued unauthorized access.
Risk Assessment
If the token is stolen, an attacker can maintain access to the account even after password change or logout.
Recommendation
Update Gitea to a patched version and advise users to log out from all devices.
Original NVD description (English source)
Gitea Remember-Me Token Theft Not Invalidating Attacker Session