CVE-2026-103504

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Gitea Limited

Description

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103504

EUVD

EUVD-2026-93914

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-272	The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in how team permissions are managed through the API. When a team's permission level is changed, such as demoting from admin to read, the team's members retain their previous higher-level access to repositories. The web form interface correctly applies the changes, but the API does not rebuild the team's per-unit access, leaving unintended elevated permissions intact.

Detection Guidance

To detect this vulnerability, check Gitea versions up to 1.27.3 for teams demoted via API that retain elevated permissions. Verify if unit permissions were not reset after demotion by inspecting team_unit records in the database. Compare API responses with actual repository access levels.

Impact Analysis

This vulnerability could allow unauthorized users to retain elevated access to repositories even after their permissions are downgraded. This may lead to data breaches, unauthorized modifications, or exposure of sensitive information if malicious actors exploit the lingering high-level access.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation within a system, which may violate compliance requirements for GDPR (data protection) and HIPAA (healthcare data security) by allowing unintended access to sensitive information.

Mitigation Strategies

Verify team permissions manually after changes via API or web form. Ensure demoted teams no longer retain elevated access. Audit repository permissions for unauthorized write access.

Hi! I’m here to help you understand CVE-2026-103504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70