Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-103504 Details

Description

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.gitea.com/release-of-28.0.0/	Gitea Limited
https://github.com/go-gitea/gitea/pull/38938	Gitea Limited
https://github.com/go-gitea/gitea/releases/tag/v28.0.0	Gitea Limited
https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46	Gitea Limited

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-272	Least Privilege Violation	Gitea Limited

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes