VDB
CVE-2026-60010
CVE-2026-60010
PUBLISHED
CVSS 6.5 MEDIUM
Reported by Gitea · Published October 14, 2026
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 15, 2026 EPSS Score
- Oct 15, 2026 CVE Updated
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-g5jj-gp8w-73h7 vendor-advisory
- Gitea 1.27.3 release announcement release-notes
- Fix: go-gitea/gitea pull request #39046 patch
- Fix: go-gitea/gitea pull request #39058 patch
- go-gitea/gitea v1.27.3 release release-notes