CVE-2026-73814: Gitea repository ownership escalation by administrators
Published Oct 14, 2026
·Updated
Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.
Affected Software
1 affected component
Gitea Gitea
Event History
Oct 14, 2026
CVE Published
via MITRE·02:38 PM
Data Sourced
via MITRE·02:38 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need before they can exploit this issue?
The attacker must be an authenticated collaborator on the target repository and already have Admin access to that repository.
2
What can an attacker do after successfully exploiting the issue?
They can elevate their effective repository permissions from Admin to Owner. Owner-level access allows owner-only actions, including transferring the repository to the attacker’s own account.