EUVD-2026-58160Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Abuse requires an authenticated repository-admin role to override the org setting, so PR:L not PR:N; network endpoint and no availability impact give AV:N/AC:L and A:N.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
AnalysisAI
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository linking endpoint ignore the RepoAdminChangeTeamAccess organization setting, so repository administrators can grant or alter team access to repositories even when an org owner has explicitly restricted that ability. This CWE-862 missing-authorization flaw undermines an intended org-level guardrail, exposing private repository contents (C:H) and permitting unauthorized permission changes (I:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user with repository-administrator privileges on a target repository within a Gitea organization, and the organization must have the RepoAdminChangeTeamAccess setting configured to restrict repo admins from changing team access (the exact guardrail the endpoint bypasses). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict and warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | In an organization where the owner has disabled RepoAdminChangeTeamAccess to keep repo admins from re-sharing repositories, a user holding only repository-admin rights calls the team-repository linking endpoint and successfully attaches an additional team - one they control or belong to - to a private repository. That team then gains read/write access to source code the org owner intended to keep restricted. … |
| Remediation | Vendor-released patch: 1.27.0 - upgrade Gitea from any 1.26.4-or-earlier build to 1.27.0 or later, following the advisory GHSA-m6qc-j894-7h9r and the release at https://github.com/go-gitea/gitea/releases/tag/v1.27.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Gitea deployments and identify instances running version 1.26.4 or earlier; flag those managing sensitive or regulated data as high priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account w
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Server-side request forgery in Gitea Open Source Git Server (all versions through 1.26.4) lets attackers abuse the repos
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today