CVE-2026-60010

MEDIUM 6.5

Gitea organization team policy bypass through repository API

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

CWE	CWE-266 CWE-863
Vendor	gitea
Product	gitea
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new medium vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 1.27.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-g5jj-gp8w-73h7 blog.gitea.com: https://blog.gitea.com/release-of-1.27.3/ github.com: https://github.com/go-gitea/gitea/pull/39046 github.com: https://github.com/go-gitea/gitea/pull/39058 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.27.3

Credits

🔍 https://github.com/akoul https://github.com/bircni