CVE-2026-73814

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814 Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814

Summary An authenticated repository collaborator with Admin access can escalate their effective permission to Owner by submitting "mode=4" to the collaboration access-mode endpoint. After the escalation, the collaborator can perform Owner-only operations, including transferring the repository to...

GO-2026-5110 Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error via the ChangeCollaborationAccessMode function. An attacker can gain owner-level privileges by exploiting an off-by-one error when modifying collaboration access modes. Remediation Upgrade gogs.io/gogs/internal/route/re...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error via the ChangeCollaborationAccessMode function. An attacker can gain owner-level privileges by exploiting an off-by-one error when modifying collaboration access modes. Remediation Upgrade...

CVE-2026-52804 Gogs: Privilege Escalation via Collaboration Access Mode Validation

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed in 0.14.3...

EUVD-2026-39072

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed in 0.14.3...

CVE-2026-52804

Summary (concrete details from provided sources): CVE-2026-52804 affects Gogs prior to 0.14.3, enabling a repository admin collaborator to escalate to owner-level access through an off-by-one error in ChangeCollaborationAccessMode. The vulnerability is triggered via mode=4 (Owner) being accepted ...

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

Summary A repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. Vulnerable Code In internal/database/repocollaboration.go, line 129: go func r Repository ChangeCollaborationAccessModeuserI...