CVE-2026-60010

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...

CVE-2026-60010

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...

PT-2026-114231

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository, even when the RepoAdminChangeTeamAccess...

CVE-2026-60010: Incorrect Privilege Assignment

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changin...