Critical · 9.1 CVE-2026-58433 EUVD-2026-58160

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Published Aug 13, 2026 · Updated Aug 14, 2026 · Assigned by Gitea

Vendor: Gitea Product: Gitea Open Source Git Server

Description

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Affected products

Vendor	Product	Affected	Fixed
Gitea	Gitea Open Source Git Server	≤ 1.26.4	—

Advisories 1

WID-SEC-2026-2304 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026

References

GitHub Security Advisory vendor-advisory
Gitea v1.27.0 Release release-notes
Gitea v1.27.0 Release Blog Post release-notes