CVE-2026-58433

The Git repository management system Gitea contains a vulnerability in the team-repository linking endpoint due to deficiencies in the authentication process . This flaw allows a remote attacker to bypass the RepoAdminChangeTeamAccess organization setting, which is intended to restrict repository...

CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

EUVD-2026-58160

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

CVE-2026-58433: Missing Authorization

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

GHSA-6C6R-5XR4-CR5M Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...