Missing Authorization in Gitea - CVE-2026-58433
Published: July 14, 2026
Vulnerability identifier: #VU137411
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58433
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to grant unauthorized repository access to team members.
The vulnerability exists due to missing authorization in the AddTeamRepository API endpoint when linking a team to a repository through the team-repository endpoint. A remote user can send a crafted api request to grant unauthorized repository access to team members.
The issue bypasses the organization's RepoAdminChangeTeamAccess setting and can expose private repository contents to current and future members of the linked team.
Affected software
Gitea
How to mitigate CVE-2026-58433
Install security update from vendor's website.
Gitea - update to 1.27.0