CVE-2026-103504 Gitea CVE debrief

Who should care

Gitea administrators and users with team management responsibilities should assess exposure and verify team permissions to ensure that demoted teams do not retain excessive access. This includes reviewing recent changes and verifying team permissions to prevent unauthorized access.

Why it matters

Defenders should prioritize verifying team permissions and reviewing recent changes to ensure that demoted teams do not retain excessive access. Gitea administrators and users with team management responsibilities should assess exposure and verify team permissions.

• Team members may retain write access to repositories after being demoted
• Demoted teams may still have elevated permissions on certain units
• Verification of team permissions is necessary to prevent unauthorized access

Technical summary

The Gitea API did not properly apply team demotion to unit permissions, allowing team members to retain previous access levels. This issue occurs when changing an organization team's permission through the API with only the `permission` field, which did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories.

Defensive priority

Defenders should prioritize verifying team permissions and reviewing recent changes to ensure that demoted teams do not retain excessive access.

Recommended defensive actions

• Verify team permissions and review recent changes to ensure that demoted teams do not retain excessive access
• Update to version 28.0.0 or later
• Review and adjust unit permissions for teams
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected versions and remediation is limited. Gitea administrators should verify team permissions and review recent changes to ensure that demoted teams do not retain excessive access. The lack of proper team demotion application to unit permissions allows team members to retain previous access levels. Defenders should prioritize verifying team permissions and reviewing recent changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.