Least Privilege Violation in Gitea - CVE-2026-103504
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to retain write and administrative unit permissions on team-linked repositories, including private repositories, after the team's permissions are reduced through the API.
The vulnerability exists due to a least privilege violation in Gitea's EditTeam API handler and access-mode parsing when processing a team demotion request containing only the permission field. Existing per-unit permissions remain unchanged, while parsing "read" or "write" as None prevents the team's top-level permission from limiting effective access. A remote user can continue using the team's retained unit permissions to perform repository operations that the organization owner intended to revoke.