CVE-2026-60010: Gitea organization team policy bypass through repository API
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be a repository administrator for a repository in an organization, while not being an organization owner. They also need access to the repository-side team-link API.
Is every Gitea organization affected?
The bypass applies when the organization has disabled RepoAdminChangeTeamAccess. In that configuration, repository administrators should be prevented from changing team access, but the repository-side API does not enforce the restriction.
What unauthorized action becomes possible?
A repository administrator can attach organization teams to the repository. This can grant repository access to teams that the organization’s policy was intended to prevent the administrator from adding.