8.1

CVE-2026-103504

Gitea API team demotion not applied to unit permissions

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGitea
≫
Produkt Gitea
Default Statusunaffected
Version <= 1.27.3
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.162
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-272 Least Privilege Violation

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

https://blog.gitea.com/release-of-28.0.0/
https://github.com/go-gitea/gitea/releases/tag/v28.0.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46
https://github.com/go-gitea/gitea/pull/38938