CVE-2026-60010

Summary "PUT /api/v1/repos/owner/repo/teams/team" allows a non-owner repository admin to attach organization teams to a repository even when the organization has disabled that behaviour with "RepoAdminChangeTeamAccess=false". An earlier advisory fixed the corresponding team-side endpoint; the...