CVE-2026-60010

6.5 Moyenne

Publiée le 14/10/2026 à 17:17 · Modifiée le 15/10/2026 à 06:18 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

Traduire en français

Produits concernés

Gitea

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-266
CWE-863

Références

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39046
https://github.com/go-gitea/gitea/pull/39058
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-g5jj-gp8w-73h7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories