CVE-2026-96589

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96589

EUVD

EUVD-2026-93925

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-672	The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea granting temporary read access to a private repository when it is transferred to a user without prior access. Canceling the transfer does not revoke this access, allowing the recipient to retain persistent read permissions indefinitely without the owner's knowledge.

Detection Guidance

Check Gitea repository settings for unexpected collaborators. Review access logs for unauthorized repository access or cloning events. Inspect transferred repositories for lingering permissions after cancellation.

Impact Analysis

If you own or manage a private repository in Gitea, an unintended user may retain unauthorized read access to sensitive code, issues, pull requests, and wiki content even after rejecting a transfer. This could lead to data leaks or unauthorized access to proprietary information.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's safeguards for protected health information. Unauthorized access risks non-compliance and potential legal consequences.

Mitigation Strategies

Manually revoke any suspicious collaborator access in Gitea. Audit all transferred repositories and remove unauthorized collaborators. Monitor repository activity for unusual access patterns.

Hi! I’m here to help you understand CVE-2026-96589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70