EUVD-2026-58160Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as repository admin
-
DeliveryCall team-repository linking endpoint
-
ExploitBypass RepoAdminChangeTeamAccess check
-
ExecutionAttach attacker-controlled team
-
ImpactGain unauthorized access to private repo
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated user with repository-administrator privileges on a target repository within a Gitea organization, and the organization must have the RepoAdminChangeTeamAccess setting configured to restrict repo admins from changing team access (the exact guardrail the endpoint bypasses). Exploitation is limited by needing that existing privileged role and a multi-team org structure where the setting is in force; single-owner or single-team deployments and instances where repo admins are already trusted to manage team access see no meaningful boundary crossing. Note the published PR:N conflicts with this repo-admin prerequisite and should be verified against the vendor advisory. |
| Impact | Signals conflict and warrant scrutiny. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.1, C:H/I:H) implies remote unauthenticated exploitation, but the description ties the abuse to a repository administrator overriding an org-owner restriction - an action that inherently requires an authenticated repo-admin role. That points to PR:L rather than PR:N, and lowers the realistic base score to roughly 8.1; verify privilege prerequisites with the Gitea advisory. Supporting the lower-urgency read, EPSS is only 0.15% (5th percentile), the issue is not in CISA KEV, and no public exploit has been identified. The impact is genuine - improper access-control changes on private code - but exploitation requires an existing privileged foothold inside an organization, making this an authorization/insider-boundary issue rather than a wormable internet-facing RCE. Treat it as a solid-priority patch for multi-tenant Gitea instances, not an emergency for isolated single-owner deployments. |
| Exploit ScenarioDerived | In an organization where the owner has disabled RepoAdminChangeTeamAccess to keep repo admins from re-sharing repositories, a user holding only repository-admin rights calls the team-repository linking endpoint and successfully attaches an additional team - one they control or belong to - to a private repository. That team then gains read/write access to source code the org owner intended to keep restricted. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository linking endpoint ignore the RepoAdminChangeTeamAccess organization setting, so repository administrators can grant or alter team access to repositories even when an org owner has explicitly restricted that ability. This CWE-862 missing-authorization flaw undermines an intended org-level guardrail, exposing private repository contents (C:H) and permitting unauthorized permission changes (I:H). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile).
RemediationAI
Vendor-released patch: 1.27.0 - upgrade Gitea from any 1.26.4-or-earlier build to 1.27.0 or later, following the advisory GHSA-m6qc-j894-7h9r and the release at https://github.com/go-gitea/gitea/releases/tag/v1.27.0. Where an immediate upgrade is not possible, compensating controls include reducing the number of accounts holding repository-admin rights in sensitive organizations and auditing team-to-repository access grants for unexpected changes, since the flaw only matters when repo admins exist below org owners; note that tightening repo-admin membership reduces day-to-day delegation flexibility. You cannot reliably re-enforce the RepoAdminChangeTeamAccess restriction on unpatched builds because the endpoint bypasses it entirely, so upgrading is the only complete fix. Review the 1.27.0 release notes (https://blog.gitea.com/gitea-1.27.0-is-released/) before rolling out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git service written in Go, offering GitHub-style organizations, teams, and repository access control. The RepoAdminChangeTeamAccess organization setting is designed so that only org owners - not repo admins - can modify which teams are granted access to a repository, a common least-privilege guardrail in multi-team organizations. The vulnerability (CWE-862, Missing Authorization) is a server-side authorization gap: the team-repository linking API endpoint performs the linking action without re-checking the RepoAdminChangeTeamAccess policy, so the security decision the setting is supposed to enforce is simply not evaluated on that code path. Affected builds are identified by CPE cpe:2.3:a:gitea:gitea_open_source_git_server:*.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Abuse requires an authenticated repository-admin role to override the org setting, so PR:L not PR:N; network endpoint and no availability impact give AV:N/AC:L and A:N.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
Lifecycle Timeline
3DescriptionCVE.org
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Executive ViewAI
Gitea versions 1.26.4 and earlier contain a critical access control vulnerability (CVSS 9.1, CWE-862) that allows repository administrators to bypass organization-level restrictions on team access modifications, creating risk of unauthorized repository exposure and permission escalation. No public exploit identified at time of analysis, but the vulnerability fundamentally undermines organizational governance by enabling malicious or compromised admins to grant themselves access to repositories an organization owner explicitly restricted. This directly impacts data confidentiality and integrity for any organization relying on Gitea's permission model.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict repository administrator role to highly-vetted personnel only; (2) disable or restrict the team-repository linking endpoint where operationally feasible; (3) implement detailed audit logging and retention for all permission changes and team modifications; (4) conduct comprehensive access review to identify any unauthorized team-repository relationships created; (5) isolate sensitive repositories from shared team access configurations pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Exploit-DB