CVE-2026-73814

6.5 Moyenne

Publiée le 14/10/2026 à 17:17 · Modifiée le 18/10/2026 à 16:16 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

Traduire en français

Produits concernés

Gitea

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-266

Références

https://blog.gitea.com/release-of-1.27.2/
https://github.com/go-gitea/gitea/pull/38894
https://github.com/go-gitea/gitea/pull/38895
https://github.com/go-gitea/gitea/releases/tag/v1.27.2
https://github.com/go-gitea/gitea/security/advisories/GHSA-h62v-wmrr-5qjq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories