Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) in gitea.dev
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6078" }
"https://vuln.go.dev/ID/GO-2026-6078.json"