CVE-2026-60010 Gitea CVE debrief

Who should care

Repository administrators, organization owners, and Gitea users with repository access should be aware of this vulnerability and take necessary actions to verify and restrict team access permissions. Organization owners may need to review and correct team access permissions, while repository administrators should ensure that they are not unintentionally granting access to unauthorized teams. Gitea users with repository access may be affected by team and

Why it matters

The team policy bypass vulnerability in Gitea's repository API allows unauthorized changes to organization team access, potentially granting access to unauthorized teams or users.

• Repository administrators may unintentionally grant access to unauthorized teams
• Organization owners may need to review and correct team access permissions
• Gitea users with repository access may be affected by unauthorized team changes

Technical summary

The Gitea repository-side team-link API does not enforce organization restrictions on repository administrators changing team access, allowing unauthorized changes to organization team access. This vulnerability can be exploited by repository administrators who are not organization owners, potentially leading to unauthorized access or changes in team permissions. The API's lack of enforcement on organization restrictions enables the bypass of team policies, which can result in security risks if not properly addressed.

Defensive priority

Repository administrators and organization owners should verify and restrict team access permissions.

Recommended defensive actions

• Verify and restrict team access permissions for repository administrators
• Update to version 1.27.3 or later
• Review organization team policies and repository access controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the team policy bypass vulnerability in Gitea's repository API. The vulnerability allows repository administrators who are not organization owners to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. Evidence from the CVE record and source item confirms the vulnerability's existence and provides context for its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.