Access Control Bypass in Gitea Collaboration Feature
CVE-2026-73814

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-73814?

The vulnerability pertains to Gitea's collaboration access-mode endpoint, which improperly permits authenticated collaborators with Admin access to escalate their permissions to Owner. This misconfiguration allows such users to execute owner-exclusive actions, including transferring repository ownership to their own account, thus undermining the security measures designed to delineate administrative and ownership roles within the Gitea ecosystem.

Affected Version(s)

Gitea 0 <= 1.27.1

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.2/
release-notes
https://github.com/go-gitea/gitea/pull/38894
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/martindukek
.