CVE-2026-60010 Details
Description
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
A vulnerability in Gitea's repository-side team-link API allows non-owner repository administrators to attach organization teams to private repositories, bypassing organizational restrictions. This issue arises because the API endpoint does not properly enforce the organization's rules regarding team access management, particularly when 'RepoAdminChangeTeamAccess' is disabled. As a result, unauthorized changes can be made to team access rights, potentially exposing private repository content and history.
Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability. Instructions for upgrading are available in the Gitea documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39046 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/39058 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-g5jj-gp8w-73h7 | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | Gitea Limited |
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |