CVE-2026-73814 Gitea CVE debrief

Who should care

Gitea administrators, repository owners, and security teams responsible for Gitea deployments should assess exposure and apply necessary patches or mitigations. They should also restrict Admin access to repository collaborators and monitor repository transfers and ownership changes. Security teams should prioritize verifying exposure and applying patches or mitigations, focusing on Gitea deployments where administrators have granted Admin access to and G

Why it matters

CVE-2026-73814 is a critical vulnerability in Gitea that allows repository collaborators with Admin access to escalate their privileges to Owner, enabling unauthorized repository transfers and other owner-only operations. Defenders should prioritize verifying exposure, applying patches or mitigations, and restricting Admin access to repository collaborators.

• Repository ownership escalation allows unauthorized repository transfers.
• Admin access can be exploited to gain Owner privileges.
• Defenders must verify exposure and apply patches or mitigations.
• Gitea deployments with Admin access granted to collaborators are at risk.

Technical summary

The vulnerability exists in Gitea's collaboration access-mode endpoint, allowing an authenticated repository collaborator with Admin access to escalate their privileges to Owner. This can lead to unauthorized repository transfers and other owner-only operations. The issue affects Gitea versions up to 1.27.1, and defenders should focus on restricting Admin access and applying patches or mitigations. Gitea administrators should assess the vulnerability's impact on their deployments, especially where Admin access is granted to collaborators.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on Gitea deployments where administrators have granted Admin access to repository collaborators.

Recommended defensive actions

• Verify Gitea version and exposure to vulnerable configurations
• Restrict Admin access to repository collaborators
• Apply patches or mitigations provided by the vendor
• Monitor repository transfers and ownership changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patches. Gitea versions up to 1.27.1 are affected. Defenders should verify exposure by reviewing Gitea deployments, especially where administrators have granted Admin access to repository collaborators. Evidence limits suggest focusing on official vendor guidance and CVE metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.