Gitea Repository Control Flaw Allows Unauthorized Team Access Modifications
CVE-2026-60010

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-60010?

A flaw in Gitea's repository-side team-link API allows repository administrators to improperly attach organization teams to repositories. This occurs even when the RepoAdminChangeTeamAccess is set to disabled, thereby ignoring the organization's restrictions on making changes to team access. As a result, unauthorized modifications can be made, potentially leading to security breaches concerning repository access.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39046
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/akoul
https://github.com/bircni
.