Vulnerability · Published Oct 6, 2026 · Assigned by Gitea

CVE-2026-103504Gitea API team demotion not applied to unit permissions

High 8.1

In plain English

A high-severity security flaw in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.3

Weakness: CWE-272 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory GHSA-x8c3-3rp8-2j46 vendor-advisory
Fix: go-gitea/gitea pull request #38938 patch
Gitea 28.0.0 release announcement release-notes
go-gitea/gitea v28.0.0 release release-notes