CVE-2026-58433

CVE-2026-58433 affects the team-repository linking endpoint in Gitea and allows bypass of the RepoAdminChangeTeamAccess organization setting. The vulnerability is documented with the CVE entry and NVD/CVE records and is referenced alongside the Gitea v1.27.0 release, implying a fix in that releas...

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

GHSA-6C6R-5XR4-CR5M Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...