CVE-2026-60010

Deferred Deferred - Pending Action

Gitea Repository Team-Link Privilege Escalation

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-60010

EUVD

EUVD-2026-101283

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-60010 is a vulnerability in Gitea where a repository administrator who is not an organization owner can attach organization teams to a repository even when the organization has disabled this behavior. This happens because the repository-side API endpoint uses a weaker permission check that can be bypassed by users with admin-level access through an attached admin team.

Detection Guidance

Check Gitea version with: curl -s http://your-gitea-instance/api/v1/version | grep version. If version is <=1.27.2, the system is vulnerable. Review audit logs for unauthorized team access changes via PUT /api/v1/repos/{owner}/{repo}/teams/{team} endpoints.

Impact Analysis

This vulnerability allows unauthorized granting of read or write access to private repositories, which could expose sensitive data or allow unauthorized modifications. Attackers with admin-level access could escalate privileges and gain unintended access to restricted resources.

Compliance Impact

This vulnerability allows unauthorized repository access changes, which could lead to unauthorized exposure or modification of sensitive data. For GDPR, this may violate principles of data protection and access control (Article 32). For HIPAA, it could compromise protected health information integrity and confidentiality if repository data includes such records.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Disable repository admin team access changes if not needed by setting RepoAdminChangeTeamAccess=false in organization settings. Review recent team access changes for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-60010. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70